RBAC without using indexes

[nouh_hussein]

Is it possible to do RBAC without indexes ? I have 5 indexes at least, but I can’t use indexes to do RBAC because all users should see all 5 indexes, but the requirement is that they should only see their data. If I ensure that the data is tagged at each of the users location, will it be possible to use these tags to only allow users that work at a specific location to be able to see their data and their data only from the 5 different indexes available ? I like RBAC indexes because it ensures that users will not see any data even if they write their own searches because they simply don’t have access to the indexes that they weren’t assigned access to but unfortunately this doesn’t work because we already indexed , and we can’t do that so we have to rely on another attribute or tag to filter the data. Please let me know if you can suggest anything.

[renjith_nair]

@nouh_hussein,

Recommended way of data separation is by using different index for different data access requirements. So suggest to re-look at the design.

Alternatively, you can combine index based and Searchfilter restrictions to achieve some degree of data isolation. However it might create performance issues.

Please refer to one of the .conf presentations for a better overview

https://conf.splunk.com/files/2017/slides/splunking-with-multiple-personalities-extending-role-based...

[nouh_hussein]

I’ve seen this document before. How secure is this method ? Can it guarantee that non of the users will be able to see any of the data that is filtered ?

[renjith_nair]

if the data access is really a security concern, suggest to separate using index. The search filters filters the data based on the search you provide and hence you need to make sure that the searches are working as expected. Suggest to simulate the user role and test it yourself.
Additionally subset of data can be copied to a summary index and provide the users access only to the respective summary index. However it needs scheduled searches to copy the data and also there will be a delay in data availability to the users based on the schedule