Security

How to configure User access based on index

Gowthamdevaraj
New Member

Hi,

I want to set up various user roles to users in my splunk instances. Like Users from Group A should only have access to index A and So on. I tried
1. creating a new role called UserGroupA and add the index A to the role and adding the inherited parent as user role.
2. Cloned user role and restrict the index to index A. but none of this worked for me.

Note: But if I restrict indexes to the role User without any additional roles added, then it's working. But my use case is to set up multiple roles based on index and allow users to access only the index results and dashboards.

Did I miss something?

Thanks.

0 Karma

solarboyz1
Builder

The recommended method:

  1. Clone the User Role, and rename as UserGroupA
  2. Modify UserGroupA allowed indexes, and ensure the role does not inherit any other roles.
  3. Assign the role to a user and verify.

https://docs.splunk.com/Documentation/Splunk/7.3.1/Security/Aboutusersandroles#How_users_inherit_all...

If this isn't working, I would first verify the roles assigned to the user:

|rest /services/authentication/users splunk_server=local 
 |fields title roles realname|rename title as userName|rename realname as Name

Ensure the user doesnt have additional roles assigned that may be allowing the user access to the index.

Next, verify the indexes that a role is given access to...both configured and inherited:

 | rest /servicesNS/nobody/system/admin/roles splunk_server=local
 | rename title as roles
 | eval idx=mvjoin(srchIndexesAllowed," ")
 | eval iidx=mvjoin(imported_srchIndexesAllowed, " ")
 | table roles idx, iidx
0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...