Security

Restrict specific users to view only certain panels

horsefez
SplunkTrust
SplunkTrust

Hi,

I'm currently trying to restrict specific users from viewing certain panels in search app. Sadly juggling around in /data/ui/views/ and metadata didn't do the trick.

How can I hide certain panels like Pivot, Alerts or Reports from a user via permissions?

alt text

Thanks in advance!

Regards,
pyro_wood

1 Solution

niketn
Legend

@pyro_wood, refer to one of my answers on similar lines. It restricts access to any Splunk Dashboard component by first pulling logged in user role through REST API call and then using Simple XML JS extension to restrict access via jQuery Selector.

https://answers.splunk.com/answers/575377/can-i-restrict-permissions-for-the-text-box-drilld.html

In your case since your requirement is to hide panel and not disable, you do not require JavaScript Extension. You should be able to achieve desired results using Simple XML. Please try out the following approach and confirm:

  1. Call REST API to get logged in User Role. Using REST call /services/authentication/current-contex, only if the logged in user has admin role associated, set the access token, else unset the access token.

  2. Add depends attribute with token access to the dashboard element/s to be hidden. In this example <panel depends="$access">

alt text

Following is the run anywhere Simple XML code based on REST API and Splunk's _internal index:

<form>
  <label>Hide Panels based on Role</label>
  <search base="baseUserRolesRESTSearch">
    <query>| search NOT roles="admin"
    </query>
    <done>
      <!-- No Results Found - Hence admin role is attached with logged in user enable text box-->
      <condition match="$job.resultCount$==0">
        <set token="access">enabled</set>
      </condition>
      <!-- Hence admin role is not attached with logged in user -->
      <condition>
        <unset token="access"></unset>
      </condition>
    </done>
  </search>
  <fieldset submitButton="false">
    <input id="time1" type="time" token="tokTime" searchWhenChanged="true">
      <label>Select Time Range</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <title>$env:user$ Access based on role: $access$</title>
        <search id="baseUserRolesRESTSearch">
          <query>| rest splunk_server=local /services/authentication/current-context 
       | table roles
           </query>
        </search>
        <option name="underLabel">Logged in user ( $env:user$ ) roles</option>
      </single>
      <html>
        <div>
          <p style="text-align:center;font-size:150%;color:blue;font-weight:bold">Following table will be displayed only for admin and hidden for non-admin</p>
        </div>
      </html>      
    </panel>
  </row>
  <row>
    <panel depends="$access$">
      <table>
        <title>Top 5 Splunk Components with Errors</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level!="INFO"
| stats count by component
| sort - count
| head 10
| eval access="$access$"
| fields - access</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
        </search>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@pyro_wood, refer to one of my answers on similar lines. It restricts access to any Splunk Dashboard component by first pulling logged in user role through REST API call and then using Simple XML JS extension to restrict access via jQuery Selector.

https://answers.splunk.com/answers/575377/can-i-restrict-permissions-for-the-text-box-drilld.html

In your case since your requirement is to hide panel and not disable, you do not require JavaScript Extension. You should be able to achieve desired results using Simple XML. Please try out the following approach and confirm:

  1. Call REST API to get logged in User Role. Using REST call /services/authentication/current-contex, only if the logged in user has admin role associated, set the access token, else unset the access token.

  2. Add depends attribute with token access to the dashboard element/s to be hidden. In this example <panel depends="$access">

alt text

Following is the run anywhere Simple XML code based on REST API and Splunk's _internal index:

<form>
  <label>Hide Panels based on Role</label>
  <search base="baseUserRolesRESTSearch">
    <query>| search NOT roles="admin"
    </query>
    <done>
      <!-- No Results Found - Hence admin role is attached with logged in user enable text box-->
      <condition match="$job.resultCount$==0">
        <set token="access">enabled</set>
      </condition>
      <!-- Hence admin role is not attached with logged in user -->
      <condition>
        <unset token="access"></unset>
      </condition>
    </done>
  </search>
  <fieldset submitButton="false">
    <input id="time1" type="time" token="tokTime" searchWhenChanged="true">
      <label>Select Time Range</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <title>$env:user$ Access based on role: $access$</title>
        <search id="baseUserRolesRESTSearch">
          <query>| rest splunk_server=local /services/authentication/current-context 
       | table roles
           </query>
        </search>
        <option name="underLabel">Logged in user ( $env:user$ ) roles</option>
      </single>
      <html>
        <div>
          <p style="text-align:center;font-size:150%;color:blue;font-weight:bold">Following table will be displayed only for admin and hidden for non-admin</p>
        </div>
      </html>      
    </panel>
  </row>
  <row>
    <panel depends="$access$">
      <table>
        <title>Top 5 Splunk Components with Errors</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level!="INFO"
| stats count by component
| sort - count
| head 10
| eval access="$access$"
| fields - access</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
        </search>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

gcusello
SplunkTrust
SplunkTrust

Hi pyro_wood,
you can restrict (or permit) access to a dashboard, a field or an index, you cannot restrict access to a panel.
So you have two choices:

  • create two dashboard, one for each role (one with all the panels and the other without the restricted panels), is more laborious to manage (you have to manage two dashboards!) but clearer for users;
  • use in the restricted panel some elaboration with restrictions (e.g. fields or an eventtype), it's easier to manage (you have only one dashboard) but less beautiful to see!

I suggest the first one!

Bye.
Giuseppe

0 Karma

horsefez
SplunkTrust
SplunkTrust

Thank you cusello,
sadly this seems to be correct!

I will try the first option, thanks!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...