Security

Restrict specific users to view only certain panels

horsefez
SplunkTrust
SplunkTrust

Hi,

I'm currently trying to restrict specific users from viewing certain panels in search app. Sadly juggling around in /data/ui/views/ and metadata didn't do the trick.

How can I hide certain panels like Pivot, Alerts or Reports from a user via permissions?

alt text

Thanks in advance!

Regards,
pyro_wood

1 Solution

niketnilay
Legend

@pyro_wood, refer to one of my answers on similar lines. It restricts access to any Splunk Dashboard component by first pulling logged in user role through REST API call and then using Simple XML JS extension to restrict access via jQuery Selector.

https://answers.splunk.com/answers/575377/can-i-restrict-permissions-for-the-text-box-drilld.html

In your case since your requirement is to hide panel and not disable, you do not require JavaScript Extension. You should be able to achieve desired results using Simple XML. Please try out the following approach and confirm:

  1. Call REST API to get logged in User Role. Using REST call /services/authentication/current-contex, only if the logged in user has admin role associated, set the access token, else unset the access token.

  2. Add depends attribute with token access to the dashboard element/s to be hidden. In this example <panel depends="$access">

alt text

Following is the run anywhere Simple XML code based on REST API and Splunk's _internal index:

<form>
  <label>Hide Panels based on Role</label>
  <search base="baseUserRolesRESTSearch">
    <query>| search NOT roles="admin"
    </query>
    <done>
      <!-- No Results Found - Hence admin role is attached with logged in user enable text box-->
      <condition match="$job.resultCount$==0">
        <set token="access">enabled</set>
      </condition>
      <!-- Hence admin role is not attached with logged in user -->
      <condition>
        <unset token="access"></unset>
      </condition>
    </done>
  </search>
  <fieldset submitButton="false">
    <input id="time1" type="time" token="tokTime" searchWhenChanged="true">
      <label>Select Time Range</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <title>$env:user$ Access based on role: $access$</title>
        <search id="baseUserRolesRESTSearch">
          <query>| rest splunk_server=local /services/authentication/current-context 
       | table roles
           </query>
        </search>
        <option name="underLabel">Logged in user ( $env:user$ ) roles</option>
      </single>
      <html>
        <div>
          <p style="text-align:center;font-size:150%;color:blue;font-weight:bold">Following table will be displayed only for admin and hidden for non-admin</p>
        </div>
      </html>      
    </panel>
  </row>
  <row>
    <panel depends="$access$">
      <table>
        <title>Top 5 Splunk Components with Errors</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level!="INFO"
| stats count by component
| sort - count
| head 10
| eval access="$access$"
| fields - access</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
        </search>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketnilay
Legend

@pyro_wood, refer to one of my answers on similar lines. It restricts access to any Splunk Dashboard component by first pulling logged in user role through REST API call and then using Simple XML JS extension to restrict access via jQuery Selector.

https://answers.splunk.com/answers/575377/can-i-restrict-permissions-for-the-text-box-drilld.html

In your case since your requirement is to hide panel and not disable, you do not require JavaScript Extension. You should be able to achieve desired results using Simple XML. Please try out the following approach and confirm:

  1. Call REST API to get logged in User Role. Using REST call /services/authentication/current-contex, only if the logged in user has admin role associated, set the access token, else unset the access token.

  2. Add depends attribute with token access to the dashboard element/s to be hidden. In this example <panel depends="$access">

alt text

Following is the run anywhere Simple XML code based on REST API and Splunk's _internal index:

<form>
  <label>Hide Panels based on Role</label>
  <search base="baseUserRolesRESTSearch">
    <query>| search NOT roles="admin"
    </query>
    <done>
      <!-- No Results Found - Hence admin role is attached with logged in user enable text box-->
      <condition match="$job.resultCount$==0">
        <set token="access">enabled</set>
      </condition>
      <!-- Hence admin role is not attached with logged in user -->
      <condition>
        <unset token="access"></unset>
      </condition>
    </done>
  </search>
  <fieldset submitButton="false">
    <input id="time1" type="time" token="tokTime" searchWhenChanged="true">
      <label>Select Time Range</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <title>$env:user$ Access based on role: $access$</title>
        <search id="baseUserRolesRESTSearch">
          <query>| rest splunk_server=local /services/authentication/current-context 
       | table roles
           </query>
        </search>
        <option name="underLabel">Logged in user ( $env:user$ ) roles</option>
      </single>
      <html>
        <div>
          <p style="text-align:center;font-size:150%;color:blue;font-weight:bold">Following table will be displayed only for admin and hidden for non-admin</p>
        </div>
      </html>      
    </panel>
  </row>
  <row>
    <panel depends="$access$">
      <table>
        <title>Top 5 Splunk Components with Errors</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level!="INFO"
| stats count by component
| sort - count
| head 10
| eval access="$access$"
| fields - access</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
        </search>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

gcusello
Legend

Hi pyro_wood,
you can restrict (or permit) access to a dashboard, a field or an index, you cannot restrict access to a panel.
So you have two choices:

  • create two dashboard, one for each role (one with all the panels and the other without the restricted panels), is more laborious to manage (you have to manage two dashboards!) but clearer for users;
  • use in the restricted panel some elaboration with restrictions (e.g. fields or an eventtype), it's easier to manage (you have only one dashboard) but less beautiful to see!

I suggest the first one!

Bye.
Giuseppe

0 Karma

horsefez
SplunkTrust
SplunkTrust

Thank you cusello,
sadly this seems to be correct!

I will try the first option, thanks!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!