multiple indexes role-based access control

[myli12]

I want to limit some users to view and search only certain data. I used multiple indexes access control.

In the "authorize.conf" which located in "\Splunk\etc\system\local", it reads

[role_c5viewer]
importRoles = user
rtSrchJobsQuota = 0
rtsearch = enabled
srchDiskQuota = 0
srchIndexesAllowed = c5only
srchIndexesDefault = c5only
srchJobsQuota = 0

If I logged as one user assigned role "c5viewer," I can only see data indexed by c5only in the search summary page. But If I put

index="r2only"

in the search bar, I can still retrieve data indexed by r2only (a different index). The results come with all the data indexed by "r2only"

Any thoughts how to enforce access control, i.e., prevent c5viewer to see data indexed by r2only? Did I put authorize.conf in the right directory?

[Ron_Naken · Accepted solution]

Judging by your "importRoles=user" statement, it looks like the c5viewer role is inheriting indexes from the user role.

You should add the following to your $SPLUNK_HOME/etc/system/local/authorize.conf:

[role_user]
srchIndexesAllowed = 

By not having an entry for the user role in your file, it grants default access to all non-internal indexes. Adding this stanza is a safer method than simply removing your "importRoles=user" statement.

For future reference, you can go to Manager-->Access Controls-->Roles to manage these properties in the UI, rather than build the file by hand.