Solved: Restrict specific users to view only certain panel...

horsefez · ‎02-14-2017

Hi,

I'm currently trying to restrict specific users from viewing certain panels in search app. Sadly juggling around in /data/ui/views/ and metadata didn't do the trick.

How can I hide certain panels like Pivot, Alerts or Reports from a user via permissions?

Thanks in advance!

Regards,
pyro_wood

niketn · ‎11-20-2017

@pyro_wood, refer to one of my answers on similar lines. It restricts access to any Splunk Dashboard component by first pulling logged in user role through REST API call and then using Simple XML JS extension to restrict access via jQuery Selector.

https://answers.splunk.com/answers/575377/can-i-restrict-permissions-for-the-text-box-drilld.html

In your case since your requirement is to hide panel and not disable, you do not require JavaScript Extension. You should be able to achieve desired results using Simple XML. Please try out the following approach and confirm:

Call REST API to get logged in User Role. Using REST call /services/authentication/current-contex, only if the logged in user has admin role associated, set the access token, else unset the access token.
Add depends attribute with token access to the dashboard element/s to be hidden. In this example <panel depends="$access">

Following is the run anywhere Simple XML code based on REST API and Splunk's _internal index:

<form>
  <label>Hide Panels based on Role</label>
  <search base="baseUserRolesRESTSearch">
    <query>| search NOT roles="admin"
    </query>
    <done>
      <!-- No Results Found - Hence admin role is attached with logged in user enable text box-->
      <condition match="$job.resultCount$==0">
        <set token="access">enabled</set>
      </condition>
      <!-- Hence admin role is not attached with logged in user -->
      <condition>
        <unset token="access"></unset>
      </condition>
    </done>
  </search>
  <fieldset submitButton="false">
    <input id="time1" type="time" token="tokTime" searchWhenChanged="true">
      <label>Select Time Range</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <title>$env:user$ Access based on role: $access$</title>
        <search id="baseUserRolesRESTSearch">
          <query>| rest splunk_server=local /services/authentication/current-context 
       | table roles
           </query>
        </search>
        <option name="underLabel">Logged in user ( $env:user$ ) roles</option>
      </single>
      <html>
        <div>
          <p style="text-align:center;font-size:150%;color:blue;font-weight:bold">Following table will be displayed only for admin and hidden for non-admin</p>
        </div>
      </html>      
    </panel>
  </row>
  <row>
    <panel depends="$access$">
      <table>
        <title>Top 5 Splunk Components with Errors</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level!="INFO"
| stats count by component
| sort - count
| head 10
| eval access="$access$"
| fields - access</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
        </search>
      </table>
    </panel>
  </row>
</form>

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn · ‎11-20-2017

@pyro_wood, refer to one of my answers on similar lines. It restricts access to any Splunk Dashboard component by first pulling logged in user role through REST API call and then using Simple XML JS extension to restrict access via jQuery Selector.

https://answers.splunk.com/answers/575377/can-i-restrict-permissions-for-the-text-box-drilld.html

In your case since your requirement is to hide panel and not disable, you do not require JavaScript Extension. You should be able to achieve desired results using Simple XML. Please try out the following approach and confirm:

Call REST API to get logged in User Role. Using REST call /services/authentication/current-contex, only if the logged in user has admin role associated, set the access token, else unset the access token.
Add depends attribute with token access to the dashboard element/s to be hidden. In this example <panel depends="$access">

Following is the run anywhere Simple XML code based on REST API and Splunk's _internal index:

<form>
  <label>Hide Panels based on Role</label>
  <search base="baseUserRolesRESTSearch">
    <query>| search NOT roles="admin"
    </query>
    <done>
      <!-- No Results Found - Hence admin role is attached with logged in user enable text box-->
      <condition match="$job.resultCount$==0">
        <set token="access">enabled</set>
      </condition>
      <!-- Hence admin role is not attached with logged in user -->
      <condition>
        <unset token="access"></unset>
      </condition>
    </done>
  </search>
  <fieldset submitButton="false">
    <input id="time1" type="time" token="tokTime" searchWhenChanged="true">
      <label>Select Time Range</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <title>$env:user$ Access based on role: $access$</title>
        <search id="baseUserRolesRESTSearch">
          <query>| rest splunk_server=local /services/authentication/current-context 
       | table roles
           </query>
        </search>
        <option name="underLabel">Logged in user ( $env:user$ ) roles</option>
      </single>
      <html>
        <div>
          <p style="text-align:center;font-size:150%;color:blue;font-weight:bold">Following table will be displayed only for admin and hidden for non-admin</p>
        </div>
      </html>      
    </panel>
  </row>
  <row>
    <panel depends="$access$">
      <table>
        <title>Top 5 Splunk Components with Errors</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level!="INFO"
| stats count by component
| sort - count
| head 10
| eval access="$access$"
| fields - access</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
        </search>
      </table>
    </panel>
  </row>
</form>

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

gcusello · ‎02-14-2017

Hi pyro_wood,
you can restrict (or permit) access to a dashboard, a field or an index, you cannot restrict access to a panel.
So you have two choices:

create two dashboard, one for each role (one with all the panels and the other without the restricted panels), is more laborious to manage (you have to manage two dashboards!) but clearer for users;
use in the restricted panel some elaboration with restrictions (e.g. fields or an eventtype), it's easier to manage (you have only one dashboard) but less beautiful to see!

I suggest the first one!

Bye.
Giuseppe

horsefez · ‎02-14-2017

Thank you cusello,
sadly this seems to be correct!

I will try the first option, thanks!

Restrict specific users to view only certain panels

Enterprise Security Content Update (ESCU) | New Releases

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

Index This | What are the 12 Days of Splunk-mas?