Security

multiple indexes role-based access control

myli12
Path Finder

I want to limit some users to view and search only certain data. I used multiple indexes access control.

In the "authorize.conf" which located in "\Splunk\etc\system\local", it reads

[role_c5viewer]
importRoles = user
rtSrchJobsQuota = 0
rtsearch = enabled
srchDiskQuota = 0
srchIndexesAllowed = c5only
srchIndexesDefault = c5only
srchJobsQuota = 0

If I logged as one user assigned role "c5viewer," I can only see data indexed by c5only in the search summary page. But If I put

index="r2only"

in the search bar, I can still retrieve data indexed by r2only (a different index). The results come with all the data indexed by "r2only"

Any thoughts how to enforce access control, i.e., prevent c5viewer to see data indexed by r2only? Did I put authorize.conf in the right directory?

Tags (1)
1 Solution

Ron_Naken
Splunk Employee
Splunk Employee

Judging by your "importRoles=user" statement, it looks like the c5viewer role is inheriting indexes from the user role.

You should add the following to your $SPLUNK_HOME/etc/system/local/authorize.conf:

[role_user]
srchIndexesAllowed = 

By not having an entry for the user role in your file, it grants default access to all non-internal indexes. Adding this stanza is a safer method than simply removing your "importRoles=user" statement.

For future reference, you can go to Manager-->Access Controls-->Roles to manage these properties in the UI, rather than build the file by hand.

View solution in original post

Ron_Naken
Splunk Employee
Splunk Employee

Judging by your "importRoles=user" statement, it looks like the c5viewer role is inheriting indexes from the user role.

You should add the following to your $SPLUNK_HOME/etc/system/local/authorize.conf:

[role_user]
srchIndexesAllowed = 

By not having an entry for the user role in your file, it grants default access to all non-internal indexes. Adding this stanza is a safer method than simply removing your "importRoles=user" statement.

For future reference, you can go to Manager-->Access Controls-->Roles to manage these properties in the UI, rather than build the file by hand.

Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...