Security

Help with Add-on permissions

irsysintegratio
Path Finder

Our customer installed our Addon using an admin account. Now the admin wants to give a power user permission to modify/use this addon. How can this be done please? The admin already granted Read/Write permission of this Addon to everyone. But still for a power user, this Addon is not shown in the available Trigger Actions selections of an Alert.

Everything works fine with the admin account. But customer wants to use the power user account to control it.

Thanks!

0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @irsyintegration, which add-on are you referring to?

0 Karma

maciep
Champion

If they go to Settings -> Alert Actions, is the alert action listed there? If so, are the permissions set correctly?

0 Karma

irsysintegratio
Path Finder

If I move the alert_actions.conf from $SPLUNK_HOME/etc/apps/OUR_ADDON/default to $SPLUNK_HOME/etc/system/local, then the power user can see it. Even though he still have trouble to edit it.

0 Karma

irsysintegratio
Path Finder

From Settings->All configurations, the power user can't find the Alert Actions.
The admin can find it from Settings->Alert Actions and Settings->All configurations, and the permission is set to Read/Write for everyone.

0 Karma

maciep
Champion

hmm, what is it set to global as well? honestly, i'm not sure exactly which permissions will it available but assume if it's global and read/write for everyone, then everyone should see it from anywhere.

side note, you can respond with comments instead of answers. answers are typically set aside as for when somebody thinks they have an answer to the question.

irsysintegratio
Path Finder

Seems to be related to the role setting of power user. If I grant admin_all_objects capability to the power user, then it works. Not sure if our customer likes it though. So still looking for alternatives.

0 Karma

irsysintegratio
Path Finder

Settings -> Alert Actions only appears for admin user, right? No such thing for power user somehow.

0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...