Security

How to configure User access based on index

Gowthamdevaraj
New Member

Hi,

I want to set up various user roles to users in my splunk instances. Like Users from Group A should only have access to index A and So on. I tried
1. creating a new role called UserGroupA and add the index A to the role and adding the inherited parent as user role.
2. Cloned user role and restrict the index to index A. but none of this worked for me.

Note: But if I restrict indexes to the role User without any additional roles added, then it's working. But my use case is to set up multiple roles based on index and allow users to access only the index results and dashboards.

Did I miss something?

Thanks.

0 Karma

solarboyz1
Builder

The recommended method:

  1. Clone the User Role, and rename as UserGroupA
  2. Modify UserGroupA allowed indexes, and ensure the role does not inherit any other roles.
  3. Assign the role to a user and verify.

https://docs.splunk.com/Documentation/Splunk/7.3.1/Security/Aboutusersandroles#How_users_inherit_all...

If this isn't working, I would first verify the roles assigned to the user:

|rest /services/authentication/users splunk_server=local 
 |fields title roles realname|rename title as userName|rename realname as Name

Ensure the user doesnt have additional roles assigned that may be allowing the user access to the index.

Next, verify the indexes that a role is given access to...both configured and inherited:

 | rest /servicesNS/nobody/system/admin/roles splunk_server=local
 | rename title as roles
 | eval idx=mvjoin(srchIndexesAllowed," ")
 | eval iidx=mvjoin(imported_srchIndexesAllowed, " ")
 | table roles idx, iidx
0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...