Configure roles

Configure flexible roles by editing authorize.conf. Roles are defined by lists of capabilities. You can also use roles to create granular access controls by setting a search filter for each role.

Caution: Do not edit or delete any roles in $SPLUNK_HOME/etc/system/default/authorize.conf. This could break your admin capabilities. Edit this file in $SPLUNK_HOME/etc/system/local/, or your own custom application directory in $SPLUNK_HOME/etc/apps/. For more information on configuration files in general, see how configuration files work.

Configuration

Add the following attribute/value pairs to $SPLUNK_HOME/etc/system/local/authorize.conf.

[role_$ROLE_NAME]
$CAPABILITY1 = enabled
$CAPABILITY2 = enabled
...
importRoles = $OTHER_ROLE
srchFilter = $SEARCH_STRING

role_$ROLE_NAME:
- the name you want to give your role, for example security, compliance, ninja.
$CAPABILITY1:
- any capability from the list below. You can have any number of capabilities for a role.
importRoles = <role>:
- when set, the current role will inherit all the capabilities from <role>.
srchFilter = <search>:
- use this field for granular access controls. Set a search string to filter on.
srchTimeWin = <string>
- maximum time span of a search

valid search strings

The srchFilter field can include any of the following search terms:

source::
host:: and host tags
eventtype:: and event type tags
search fields
wildcards
use OR to use multiple terms, or AND to make searches more restrictive

Note: Members of multiple roles inherit capabilities from the role with the highest permissions. To set a more restrictive search filter for such users, make a new role.

The search terms cannot include:

indexes
source types
saved searches
time operators
regular expressions
any fields or modifiers Splunk Web can overwrite

map a role to a user

Once you've created a role in authorize.conf, map it to a user via Splunk Web.

Click on the admin link in the upper right-hand corner.
Then, select the Users tab.
Enter the username, password and full name.
Choose which role to map to from the Role list.
- Any custom roles you have created via authorize.conf should be listed here.

Note: You must restart Splunk after making changes to authorize.conf. Otherwise, your new roles will not appear in the Role list.

lock dashboards for roles

You can lock a dashboard for a role via web.conf.

In $SPLUNK_HOME/etc/system/local/web.conf add the following:

disablePersistedPrefs = <role>

This prevents any changes a role makes from being written to prefs.conf.

Example

The following example creates the role of Ninja. This user can do everything listed as capabilities (eg edit_input). Also, the Ninja role imports the capabilities of the Security and Compliance roles -- meaning Ninja can do everything (and more) that Security and Compliance can do. Additionally, there is a search filter which means that Ninja can only run searches on hosts swan or pearl.

[role_Ninja]
edit_input                = enabled
delete_input              = enabled
edit_global_save_search   = enabled
delete_global_save_search = enabled
create_alert              = enabled
start_alert               = enabled
start_global_alert        = enabled
stop_alert                = enabled
stop_global_alert         = enabled
save_local_eventtype      = enabled
edit_role_search          = enabled
edit_local_search         = enabled
edit_saved_search         = enabled
savesearch_tab            = enabled
allow_livetail            = enabled
importRoles = Security;Compliance
srchFilter = host=swan OR host=pearl

Previous: SSL | Next: Set up LDAP

Comments

No comments have been submitted.