Security

dbmon permissions issue

mjones414
Contributor

Ever since upgrading splunk DB connect to a version that supports the dbx_user role I've been working out odd permissions issues and so far I've been able to get most of them sans one.

I had a decent handful of db inputs created prior to upgrading to a version of the app with dbx_user defined. I've since retroactively added dbx_user to all the users needing access and they can manage their database connections fine but they cannot create new or modify their existing dbmon inputs whether they are tail or dumps.

The error they are receiving is:

There was an error retrieving the configuration, can not process this page.

Splunk administrators are not having any issues.

the current local.meta for db connect is as follows:

[]
access = read : [ dbx_user, admin ], write : [ admin ]

### Manager ###

[manager]
export = system

[manager/databases]
export = system

[manager/dbmon]
export = system
access = read : [ admin , dbx_user ], write : [ admin , dbx_user ]

[manager/dblookups]
export = system
access = read : [ admin ,dbx_user  ], write : [ admin ,dbx_user ]

### Commands ###

[commands/dbquery]
export = system

[commands/dbinput]
export = system

[commands/dbinfo]
export = system

[commands/dboutput]
export = system

[commands/dbmonpreview]
export = none
access = read : [ admin, dbx_user ], write : [ admin ]


### Other settings ###

[inputs/dbmon-*]

[inputs]
access = read : [ dbx_user, admin ], write : [ admin , dbx_user]

[transforms]
access = read : [ dbx_user, admin ], write : [ admin , dbx_user]

[props]
export = system

[transforms]
export = system

[eventtypes]
export = system

[lookups]
export = system

[searchscripts]
export = system

[database]
access = read : [ dbx_user, admin ], write : [ admin , dbx_user]

[dblookup]
access = read : [ dbx_user, admin ], write : [ admin , dbx_user]
0 Karma
1 Solution

araitz
Splunk Employee
Splunk Employee

I think the problem is because creating an input requires the admin_all_objects permission, which as the name implies means having essentially unlimited access.

View solution in original post

0 Karma

araitz
Splunk Employee
Splunk Employee

I think the problem is because creating an input requires the admin_all_objects permission, which as the name implies means having essentially unlimited access.

0 Karma

mjones414
Contributor

Wow.. That's a bummer 😞 I wonder if there is any way to work this in as a feature request to have that tied to the dbx_user role...

Thank you! I will mark as answered until a way has been discovered. 🙂

0 Karma

mjones414
Contributor

The version of DB Connect I'm using is 1.1.3 with splunk enterprise 6.0.3

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...