Security

How to configure User access based on index

Gowthamdevaraj
New Member

Hi,

I want to set up various user roles to users in my splunk instances. Like Users from Group A should only have access to index A and So on. I tried
1. creating a new role called UserGroupA and add the index A to the role and adding the inherited parent as user role.
2. Cloned user role and restrict the index to index A. but none of this worked for me.

Note: But if I restrict indexes to the role User without any additional roles added, then it's working. But my use case is to set up multiple roles based on index and allow users to access only the index results and dashboards.

Did I miss something?

Thanks.

0 Karma

solarboyz1
Builder

The recommended method:

  1. Clone the User Role, and rename as UserGroupA
  2. Modify UserGroupA allowed indexes, and ensure the role does not inherit any other roles.
  3. Assign the role to a user and verify.

https://docs.splunk.com/Documentation/Splunk/7.3.1/Security/Aboutusersandroles#How_users_inherit_all...

If this isn't working, I would first verify the roles assigned to the user:

|rest /services/authentication/users splunk_server=local 
 |fields title roles realname|rename title as userName|rename realname as Name

Ensure the user doesnt have additional roles assigned that may be allowing the user access to the index.

Next, verify the indexes that a role is given access to...both configured and inherited:

 | rest /servicesNS/nobody/system/admin/roles splunk_server=local
 | rename title as roles
 | eval idx=mvjoin(srchIndexesAllowed," ")
 | eval iidx=mvjoin(imported_srchIndexesAllowed, " ")
 | table roles idx, iidx
0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...