How to tie capabilities to custom roles so certain options are hidden based on the user logging in?

[tradez]

We've built a heavily customized OEM Application for our product and I would like to know how to make certain things aware of the user role and hide/show them based on who logged in.

The example would be:

• I have a button on reports that allows a user to create a new firewall policy based on the the row in the alert/report.
  
• I would like the capability to have this grey out or even just be hidden if a user is logged in as one person versus another.
  
• I suppose I could do this by creating 2 apps (admin and user) and just making the right one the default for that user and the other not accessible to the other, but this is not as elegant and adds a lot of complexity to our distribution.

Thanks!

[jkat54]

You cant easily create new capabilities. Suggest that you partner with splunk as OEM provider and use their support & resources to achieve this.

[tradez]

To clarify, i already have the capabilities to say add a new rule to a firewall from within our app. This question is in regards to even the most basic ability to say make a specific statistics table on an app only show up if the right user is logged in.

[jkat54]

I'm talking about splunk capabilities like:
admin_all_objects, edit_lookups
http://docs.splunk.com/Documentation/Splunk/6.3.2/Security/Rolesandcapabilities

Have you created your own "splunk capability"? I doubt so.

So what you want to do is get a list of the user's (person running search) capabilities, see if the user has capability xyz, and if so display the edit button. Are you using an SDK? If so, which one?

For example in Python SDK, there is:

class splunklib.client.User(service, path, **kwargs)
This class represents a Splunk user.

Which has a method called "role_entities" which will return a list of the user's roles. You could make a role called can_see_edit_button... give that role to everyone you want to have the edit button.. then in your code check to see if splunklib.client.User(service,path).role_entities contains "can_see_edit_button" or not.