Security

Is there a capability that will allow me to only list user accounts via the REST Endpoint and not modify or delete them?

ryanoconnor
Builder

Looking to audit user accounts on a number of Splunk systems, but I don't want to have to have admin level permissions to do this. Looking for a capability that is built in that I can use to create a role that will then allow me to list user accounts without having the ability to modify or delete them. Has anyone done this before? I know there is a capability called "edit_user" but I was hoping for one called "list_user".

http://docs.splunk.com/Documentation/Splunk/6.5.0/Security/Rolesandcapabilities

0 Karma

somesoni2
Revered Legend

Look at capability capability::rest_properties_get and capability::rest_properties_set. I guess if you create a capability same as "user" role minus the capability::rest_properties_set, it should allow only read access to REST API Endpoints. (haven't tried).

0 Karma

horsefez
SplunkTrust
SplunkTrust

As somesoni said already,

I would also point you at capabilities like
rest_....
or
list_....

Additionally I can provide you with a search that will help you list the current users and their capabilities:

| rest /services/authentication/users splunk_server=* | dedup title | fields title roles | rename title AS User roles AS Role
0 Karma

ryanoconnor
Builder

I already have a search that will do this. Unfortunately the answer he had won't work. Those capabilities are for a different REST endpoint.

0 Karma

masonmorales
Influencer

Why wouldn't it work? You can specify different rest endpoints using the splunk_server=....

The other endpoint just needs to be in the distributed search config.

0 Karma

ryanoconnor
Builder

According to: http://docs.splunk.com/Documentation/Splunk/6.5.0/Security/Rolesandcapabilities

The capabilities rest_properties_set and rest_properties_get are used for the services/properties endpoint.

0 Karma

ryanoconnor
Builder

Unfortunately that wouldn't work. Those capabilities are for the /services/properties. I'm looking to hit the /services/authentication/ endpoint.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!