Deployment Architecture

DB Connect - access restrictions to database connections not working

martin_mueller
SplunkTrust
SplunkTrust

I'm trying to set up db connections with role-based access restrictions. As an example, Splunk role A shall be able to run dbquery using database connection dbA and Splunk role B shall do the same with dbB. Neither can run queries on the other database.

According to http://docs.splunk.com/Documentation/DBX/1.1.1/DeployDBX/Setupuserpermissions#Set_up_user_access_to_... the permissions for a db connection object should provide this level of access control. However, I can't get that to work. Regardless of how restricted I set the permissions for a database connection, a non-privileged user (role B) can still access that database (dbA) through dbquery - even if that database connection is set as private rather than app- or global-shared.

Is anyone able to reproduce this or am I missing something?

0 Karma

linu1988
Champion

i had reported similar concerns..

0 Karma

sroback_splunk
Splunk Employee
Splunk Employee

Martin,

The dev team has opened a ticket on this issue and is currently investigating. Looks like it might be a bug.

araitz
Splunk Employee
Splunk Employee

Yes, the current implementation is sub-optimal, but it was too risky to try to fix that issue comprehensively.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

...

currentUser = settings['owner']
ent = en.getEntity(["dbx", "databases"], entityName=dbn, namespace="dbx", owner=currentUser, sessionKey=sessionKey)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I see this has been addressed in 1.1.2, thanks!

However, I fear the fix may have added a new bug. See line 14 of dbquery.py:

ent = en.getEntity(["dbx", "databases"], entityName=dbn, namespace="dbx", owner="nobody", sessionKey=sessionKey)

That loads the REST endpoint using the namespace /servicesNS/nobody/dbx/..., which works well for app- or global-shared objects. Sadly this breaks privately held DB connection objects. In order to fix that, replace with these two lines (next comment):

0 Karma

linu1988
Champion

I have found something..

While doing | dboutput type=sql database=test table=minimom "update .."

Irrespective of the update success/failure it always says no modification done!!!

Is that a miss in the return statement from database query or something?

martin_mueller
SplunkTrust
SplunkTrust

Great, thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...