How to get the list of roles of the logged in user in a drop-down form using REST or search?

[lakshman237]

Hi,

We are on 6.2.2 on Linux. We have a form where we want to capture the list of roles the logged in user has, so the form shows the roles in the drop-down based on the user logging on to the system.

Any pointers?

thanks
laks

[martin_mueller]

Like so:

| rest splunk_server=local /services/authentication/current-context | table username roles

Depending on your specific form you may want to mvexpand on the roles.

[lakshman237]

Sorry for the delay martin. The issue is the values passed via Content-Type in different browsers are not fully supported. I have raised a case with splunk - SPL-103335. As a workaround, splunk has advised to make the changes in splunk.js and splunk.min.js to allow different Content-type, which we are testing now.

[martin_mueller]

How is that relevant to the question?

[martin_mueller]

In the Activity view, click the "search-string-link" to view the results of that job without running the search again. See if that yields results that fit to the results expected by the dropdown.

[martin_mueller]

That looks okay. You say "doesn't work", doesn't work how? No values in the dropdown? No successful filtering in the panels below?
When you open the form, does a corresponding job appear in the Activity view linked to in the top right corner?

[lakshman237]

There is no value in the drop-down and no values in the panels below. Yes, I can see the underlying search being triggered in the 'activity' view

[martin_mueller]

Do post the XML segment of your input tag.

[lakshman237]

<input type="dropdown" token="field1" searchWhenChanged="false">
  <choice value="*">All</choice>
  <search>
    <query>|rest splunk_server=local /services/authentication/current-context | table username,roles | mvexpand roles|search roles="roles*" | eval SPID = mvindex(split(roles,"-"),1) | dedup SPID | table SPID</query>
    <earliest>0</earliest>
  </search>
  <fieldForLabel>SPID</fieldForLabel>
  <fieldForValue>SPID</fieldForValue>
  <default>*</default>
</input>

[lakshman237]

Thanks Martin. This works in a standalone splunk instance and when I integrate with SSO via Apache proxy, the above doesn't work in the form. However, if I run the same search in the 'search bar' of the search app. it shows the roles. Am I missing anything?