Users getting permission errors when attempting to run dataset command.

scalyr / dataset-addon-for-splunk

The DataSet Add-on for Splunk provides integration with

Apache License 2.0

3 stars 10 forks source link

Users getting permission errors when attempting to run dataset command. #141

Closed NovTangoPapa closed 1 day ago

NovTangoPapa commented 1 month ago

This is the error that is received.

Power users are not able to run dataset custom command, I as admin am able to run it.

Verified the users who cannot access have list_storage_option capability.
Checked all assets related to the app to ensure they are set to global

System:

Splunk Cloud
Addon Version 2.0.61

What are other permissions that are required to use this custom command?

mcgrail-s1 commented 1 month ago

Unable to reproduce this issue with same TA version:

As admin, configured the TA along with URL and API key
Created a new role inherited from user, and added list_storage_passwords
Added test user to the new role
Logged in as test user and ran | dataset without issue

Troubleshooting:

Can you confirm the TA is configured with an account?
Does the user role have list_storage_passwords?
Can the user access the Singularity Data Lake Add-on > Configuration > Account page?
Can you share the search log from the user having issues (with anything sensitive redacted, of course)?
Was this working previously and stopped working (regression) or is this a net new install/configuration?

NovTangoPapa commented 1 month ago

Can you confirm the TA is configured with an account?
- TA is configured with an account.
Does the user role have list_storage_passwords?
- Users role does have list_storage_passwords
Can the user access the Singularity Data Lake Add-on > Configuration > Account page?
- User can see the page, but the account is not listed for them.
Can you share the search log from the user having issues (with anything sensitive redacted, of course)?
- search.log
Was this working previously and stopped working (regression) or is this a net new install/configuration?
- We have had it setup for a bit, but only recently started switching over everything to use the custom command instead of cloudfunnel logs we were ingesting. So as far as we know this has been like this from the beginning. To reiterate, any user with sc_admin can run it, but power users cannot.

epic-david commented 1 month ago

I'm running into this same issue on version 2.0.71, same symptoms as the above post. It worked on version 2.0.0 (recently upgraded from 2.0.0 -> 2.0.71)

epic-david commented 1 month ago

I'm running into this same issue on version 2.0.71, same symptoms as the above post. It worked on version 2.0.0 (recently upgraded from 2.0.0 -> 2.0.71)

Just to double check, I downgraded the app back to 2.0.0 and it started working normally again.

mcgrail-s1 commented 1 week ago

Confirmed default.meta was incorrectly modified several versions back. Workaround is to check app permissions and ensure all users have read access to the TA.

New version is slated to be published shortly to fix this regression.

jmorascalyr commented 4 days ago

Latest version here https://github.com/scalyr/dataset-addon-for-splunk/tree/v2.0.72

epic-david commented 2 days ago

I can confirm the latest version (2.0.72) resolved the issue for me.