Security
Highlighted

Help in identifying the capabilities for REST search to fetch User/Role/App details

Hi all,
I have the below rest searches to fetch the User, Role and Application details, respectively.

  • | rest /services/authentication/users
  • | rest /services/authorization/roles
  • | rest /services/apps/local

However, am not able to define the exact read only capabilities for my role to assign, so I can run these searches to get the results.

Below are the capabilities I investigated:
editroles
edit
user
restpropertiesget
search

However, am not getting the entire application list as compared to Admin role. Also the editroles and edituser are giving write permission and am looking for read permission only.

Please help.

0 Karma
Highlighted

Re: Help in identifying the capabilities for REST search to fetch User/Role/App details

SplunkTrust
SplunkTrust

Can you elaborate a little here?
what is the problem you are trying to solve?
What is the outcome / search output you are anticipating?

0 Karma
Highlighted

Re: Help in identifying the capabilities for REST search to fetch User/Role/App details

I have a certain dashboard listing all Splunk users and what role-capabilities are assigned to them. For which I have used the above mentioned Rest API commands.

However the dashboard users are not able to see the results as they don't below capabilities.

edit_roles
edit_user
rest_properties_get
search

If I assign these capabilities to them, then they can delete/update the user-role information from GUI settings, which I don't want.

0 Karma
Highlighted

Re: Help in identifying the capabilities for REST search to fetch User/Role/App details

Super Champion

Please check if the answer https://answers.splunk.com/answers/745460/rest-call-in-subsearch.html helps you
The original query is for indexes, but you can put the other REST endpoints change to see if it works.

0 Karma