Security

How to get the list of roles of the logged in user in a drop-down form using REST or search?

lakshman237
Path Finder

Hi,

We are on 6.2.2 on Linux. We have a form where we want to capture the list of roles the logged in user has, so the form shows the roles in the drop-down based on the user logging on to the system.

Any pointers?

thanks
laks

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Like so:

| rest splunk_server=local /services/authentication/current-context | table username roles

Depending on your specific form you may want to mvexpand on the roles.

lakshman237
Path Finder

Sorry for the delay martin. The issue is the values passed via Content-Type in different browsers are not fully supported. I have raised a case with splunk - SPL-103335. As a workaround, splunk has advised to make the changes in splunk.js and splunk.min.js to allow different Content-type, which we are testing now.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

How is that relevant to the question?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

In the Activity view, click the "search-string-link" to view the results of that job without running the search again. See if that yields results that fit to the results expected by the dropdown.

martin_mueller
SplunkTrust
SplunkTrust

That looks okay. You say "doesn't work", doesn't work how? No values in the dropdown? No successful filtering in the panels below?
When you open the form, does a corresponding job appear in the Activity view linked to in the top right corner?

0 Karma

lakshman237
Path Finder

There is no value in the drop-down and no values in the panels below. Yes, I can see the underlying search being triggered in the 'activity' view

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Do post the XML segment of your input tag.

0 Karma

lakshman237
Path Finder
<input type="dropdown" token="field1" searchWhenChanged="false">
  <choice value="*">All</choice>
  <search>
    <query>|rest splunk_server=local /services/authentication/current-context | table username,roles | mvexpand roles|search roles="roles*" | eval SPID = mvindex(split(roles,"-"),1) | dedup SPID | table SPID</query>
    <earliest>0</earliest>
  </search>
  <fieldForLabel>SPID</fieldForLabel>
  <fieldForValue>SPID</fieldForValue>
  <default>*</default>
</input>
0 Karma

lakshman237
Path Finder

Thanks Martin. This works in a standalone splunk instance and when I integrate with SSO via Apache proxy, the above doesn't work in the form. However, if I run the same search in the 'search bar' of the search app. it shows the roles. Am I missing anything?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!