Splunk Search

Block access to Manager

steveirogers
Communicator

I have seen several questions about restricting access to "Manager" but all of the answers seem to require coding JavaScript.
I do not understand why this is not a "built-in" capability.

I have defined a new role that only has search capability to a specific index. Yet the users in that role have administrative ability via the "Manager" link to change configuration settings. That does not make any sense.

Is there a different way to accomplish this besides coding/modify XML?

I am running Splunk 4.0.3 build 65638.

Tags (1)
0 Karma
1 Solution

mfrost8
Builder

I don't have a solution for you, but perhaps more of a question. Is it your intent to prevent non-admin users from being able to say, change their password? non-admin users don't get all the of the admin content from manager. In our shop, we leave that all alone as there's nothing sensitive or damaging that non-admin roles get access to.

If it really has to go away completely for non-admins, I would think that that is unusual enough that yes, you'd need to modify the XML.

View solution in original post

steveirogers
Communicator

Thanks Frank. I will check into that as well.

0 Karma

mw
Splunk Employee
Splunk Employee

The Manager link doesn't immediately just give them admin access. Users have their own "knowledge objects" such as searches and macros. They access to these through Manager. They have access to what they create or what you give them access to. If you don't want them to have access to something, manage the permissions of it.

0 Karma

mfrost8
Builder

I don't have a solution for you, but perhaps more of a question. Is it your intent to prevent non-admin users from being able to say, change their password? non-admin users don't get all the of the admin content from manager. In our shop, we leave that all alone as there's nothing sensitive or damaging that non-admin roles get access to.

If it really has to go away completely for non-admins, I would think that that is unusual enough that yes, you'd need to modify the XML.

mfrost8
Builder

I'm not certain how that works. I would guess that might create configuration within a user's own, local configuration ($SPLUNK_HOME/etc/users/) so it's not tweaking the global config.

If you don't even want that, you might want to file an enhancement request asking for field extractions to be a capability you can remove from the "user" role (I don't see it there currently as a capability).

0 Karma

steveirogers
Communicator

Thanks very much. I did some more testing and you are correct in that most of the actual fields are restricted when the user clicks on the manager link. However, if the user goes to "Manager --> Field Extractions", then it appears that they can change some of the values in "transforms.conf" and save the changes.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...