Security

How can I give read access to all apps for a certain role?

ddrillic
Ultra Champion

I need to give read access to all apps for a certain role. How can I do that?

0 Karma

hettervi
Builder

Hi! Did you ever find out if there was a way of doing this? I have the same problem.

0 Karma

sbbadri
Motivator

@ddrillic

create a user role in authorize.conf with proper capabilites. Map the user role with the proper AD group (you belongs to ) in authentication.conf .

optional: you can add this splreadaccess_user in default.meta. Because your role has inherited user and power role. so that you can read all apps.

for e.g,
authorize.conf

[role_splreadaccess_user]
cumulativeRTSrchJobsQuota = 0
cumulativeSrchJobsQuota = 0
importRoles = power;user
srchIndexesAllowed = *
srchIndexesDefault = *
srchMaxTime = 0
use_file_operator = enabled

authentication.conf

splreadaccess_user = adgroup1

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

I'm reading your question as, "I need to set up a role which will have read access on all apps." Did I get that right?

0 Karma

ddrillic
Ultra Champion

Absolutely - that's right.

0 Karma

ddrillic
Ultra Champion

Any thoughts on that?

0 Karma

agarrison
Path Finder

I think your looking for something like this,
http://docs.splunk.com/Documentation/Splunk/6.1/admin/Defaultmetaconf
You can set the default permissions for apps.

0 Karma

ddrillic
Ultra Champion

Good but I prefer not to get into each single app and do it... if possible ; -)

0 Karma

agarrison
Path Finder

That defaultmetaconf should apply to all apps unless they have something else specified for the specific app to overwrite that one.

0 Karma
Get Updates on the Splunk Community!

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...