Security

How to configure User access based on index

Gowthamdevaraj
New Member

Hi,

I want to set up various user roles to users in my splunk instances. Like Users from Group A should only have access to index A and So on. I tried
1. creating a new role called UserGroupA and add the index A to the role and adding the inherited parent as user role.
2. Cloned user role and restrict the index to index A. but none of this worked for me.

Note: But if I restrict indexes to the role User without any additional roles added, then it's working. But my use case is to set up multiple roles based on index and allow users to access only the index results and dashboards.

Did I miss something?

Thanks.

0 Karma

solarboyz1
Builder

The recommended method:

  1. Clone the User Role, and rename as UserGroupA
  2. Modify UserGroupA allowed indexes, and ensure the role does not inherit any other roles.
  3. Assign the role to a user and verify.

https://docs.splunk.com/Documentation/Splunk/7.3.1/Security/Aboutusersandroles#How_users_inherit_all...

If this isn't working, I would first verify the roles assigned to the user:

|rest /services/authentication/users splunk_server=local 
 |fields title roles realname|rename title as userName|rename realname as Name

Ensure the user doesnt have additional roles assigned that may be allowing the user access to the index.

Next, verify the indexes that a role is given access to...both configured and inherited:

 | rest /servicesNS/nobody/system/admin/roles splunk_server=local
 | rename title as roles
 | eval idx=mvjoin(srchIndexesAllowed," ")
 | eval iidx=mvjoin(imported_srchIndexesAllowed, " ")
 | table roles idx, iidx
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...