Security

After upgrading Splunk from 6.2.x to 6.3, users with power role are getting "403 Forbidden" using debug/refresh URL. What capabilities are needed?

flee
Path Finder

We have users in Power role that were using ...debug/refresh URL in v6.2.x. However, after we upgraded to v6.3, those users are not able to use the debug/refresh anymore. They're now getting error message "403 Forbidden. Unauthorized to access this resource." page instead.

I added the run_debug_commands capabilities which was not included previously to the role, but they're still getting the same 403 error.

Is there any other capabilities needed?

Thanks for your help.

1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Try adding web_debug capabilities as well. This is configured in authorize.conf and the admin role has this by default. Also for 6.3, in web.conf the following setting must be set to true:

enableWebDebug = true|false
- Controls the visibility of the debug endpoints (i.e., /debug/**splat).
- Defaults to false

Similar question : https://answers.splunk.com/answers/312428/why-am-i-no-longer-able-to-access-sso-and-echo-deb.html

Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

Try adding web_debug capabilities as well. This is configured in authorize.conf and the admin role has this by default. Also for 6.3, in web.conf the following setting must be set to true:

enableWebDebug = true|false
- Controls the visibility of the debug endpoints (i.e., /debug/**splat).
- Defaults to false

Similar question : https://answers.splunk.com/answers/312428/why-am-i-no-longer-able-to-access-sso-and-echo-deb.html

Happy Splunking!

flee
Path Finder

Thanks renjith.nair! It worked. Since I only wanted a specific role to have this capability, I added web_debug only to the role.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...