Security

How to allow a specific new role the capability to install apps?

fernandoandre
Communicator

After the creation of a new role, with limited capabilities, my question is:
is it possible to allow this role with the capability to install and manage apps?

Basically the users on this role can search, save searches/alerts, build dashboards, but almost nothing else besides these capabilities. However I want this role to be able to install Splunk apps from Splunk App site.
The configuration for the role is similar to the following:

[role_NAME]
change_own_password = enabled
cumulativeRTSrchJobsQuota = 6
cumulativeSrchJobsQuota = 8
pattern_detect = enabled
rest_apps_view = enabled
rest_properties_get = enabled
rtSrchJobsQuota = 4
rtsearch = enabled
schedule_search = enabled
search = enabled
srchDiskQuota = 500
srchIndexesAllowed = indexX;indexY
srchIndexesDefault = indexX;indexY
srchJobsQuota = 6
srchMaxTime = 0
srchTimeWin = 2592000
use_file_operator = enabled
Tags (3)

thomrs
Communicator

I think you may need rest_apps_management to add apps. We only let admins install apps in prod so cant say for 100%. Below is a list of all capabilities, worse case a little trial and error will get you there.

http://docs.splunk.com/Documentation/Splunk/latest/Security/Rolesandcapabilities#List_of_available_c...

0 Karma

fernandoandre
Communicator

We have tried that. It allows to install apps through a web interface but it doesn't allow to upload the app files or to manage the apps, namely disable/enable them.

I have played around with configurations, in particular I have found out that if a role is imported like the following:

importRoles = admin

or user, or power role, even if you disable the capabilities afterwards, these are overridden. For example, with the configuration above, even if the following is inserted in the authorize.conf file, it isn't applied.

license_tab = disabled
license_edit = disabled

Anyone with similar problem or solution?

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...