Security

What capability allows you to search /services/authentication/users?

pkeller
Contributor

I want to grant access to a non-admin role to: | rest /services/authentication/users, but am not sure what capability that requires.
I've granted the role rest_apps_management but that didn't seem to do the trick.

0 Karma
1 Solution

starcher
SplunkTrust
SplunkTrust

I would not recommend giving out direct api access. as @somesoni2 suggested it might give more than you want. I would use a scheduled search like the below to maintain a table and give them permissions to that.

| rest /services/authentication/users | table title, realname, roles, type, capabilities | mvexpand capabilities | rename title as username | outputlookup splunk_user_access.csv

View solution in original post

0 Karma

sbattista09
Contributor

is there a index filed you can add as will to show what indexes they have access to?

0 Karma

starcher
SplunkTrust
SplunkTrust

I would not recommend giving out direct api access. as @somesoni2 suggested it might give more than you want. I would use a scheduled search like the below to maintain a table and give them permissions to that.

| rest /services/authentication/users | table title, realname, roles, type, capabilities | mvexpand capabilities | rename title as username | outputlookup splunk_user_access.csv
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try with change_authentication capability. Please note that this may provide additional access than just GET on /services/authentication/users.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...