Splunk Cloud Platform

Search Manual

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Service accounts and federated search security

Before you define a remote Splunk platform deployment as a federated provider, create a service account on that remote deployment. The service account enables secure communication between the federated search head on your local Splunk platform deployment and the federated provider.

For the purposes of federated search, communication between local and remote Splunk platform search heads is facilitated by an internal REST API endpoint on port 8089, using HTTPS with TLS 1.2 encryption. You can set up HTTPS proxy data transmission for federated search. Federated search does not support HTTP proxy data transmission.

Federated search security models

A service account enables different security models depending on whether or not Local Knowledge Objects is enabled or disabled for the federated provider.

Local Knowledge Objects setting Applies to Security model Description
Disabled Standard mode federated providers, by default. Data access privileges and restrictions derive from the service account role, which is defined on the remote Splunk platform deployment. Users running federated searches on the local deployment delegate their security to the role held by the service account user on the remote deployment.

This role is defined on the remote deployment.

Access privileges and restrictions set on the service account role apply to all federated searches run over the remote deployment.
Enabled
  • Standard mode federated providers, when you enable Local Knowledge Objects.
  • Transparent mode federated providers, always.
Data access privileges and restrictions derive from the role of the user running the federated search on the local Splunk platform deployment. Users running federated searches on the local deployment have their role access privileges and restrictions applied to the federated search.

This application of user role-based access controls takes place only when the service account role on the remote Splunk platform deployment has the fsh_manage capability.

For more information about the standard and transparent federated provider modes, see About federated search.

For more information about the Local Knowledge Objects setting, see Determine which knowledge objects are applied to federated searches.

Step one: Create a role on the remote Splunk deployment

To set up a federated provider service account on a remote Splunk deployment, you must first create an appropriate service account role on that deployment. This task differs depending on whether the federated provider you are setting up the service account for will have Local Knowledge Objects enabled or disabled.

If the federated provider will have Local Knowledge Objects disabled

Local knowledge objects is disabled by default for standard mode federated providers.

If the remote Splunk platform deployment you are defining as a standard mode federated provider will have Local Knowledge Objects disabled, create a new service account role on the remote deployment. This is the role you will give to the service account user for the federated provider. This role provides the access controls for all federated searches run over this federated provider.

See Create and manage roles with Splunk Web.

  1. On the remote deployment, in Splunk Web, navigate to Settings > Roles.
  2. Click New Role.
  3. Give the role a unique Name.

    Role names must use lowercase characters only. They cannot contain spaces, colons, or forward slashes. You cannot edit the names of existing roles.

  4. Ensure that the role has appropriate access to data on the remote Splunk platform deployment for the federated searches your users will be running. Specify role inheritance, capabilities, searchable indexes, search restrictions, and search-related limits.
    To ensure that the service account role has the essential capabilities for running searches, make sure the role inherits its baseline capabilities from the User role.
  5. Click Save.

If the federated provider will have Local Knowledge Objects enabled

You can optionally enable Local Knowledge Objects for standard mode federated providers. Local Knowledge Objects is always enabled for transparent mode federated providers.

If the remote Splunk platform deployment you are defining as a federated provider will have Local Knowledge Objects enabled, create a new service account role on the remote deployment and give the role the fsh_manage capability. This is the role you will give to the service account user for the federated provider.

When you give the federated provider service account a role with the fsh_manage capability, you effectively grant the admin of the federated search head on the local Splunk deployment the privilege to authorize access to indexes on the remote deployment.

If you have Local Knowledge Objects enabled for a federated provider and that federated provider's service account does not have a role with the fsh_manage capability, that federated provider rejects all federated search requests that reach it.

See Create and manage roles with Splunk Web.

  1. On the remote deployment, in Splunk Web, navigate to Settings > Roles.
  2. Click New Role.
  3. Give the role a unique Name.

    Role names must use lowercase characters only. They cannot contain spaces, colons, or forward slashes. You cannot edit the names of existing roles.

  4. Click 2. Capabilities to display the contents of the Capabilities tab.
  5. Click the checkbox next to the fsh_manage capability.
    No other role settings are required. When you run a federated search over this provider, the remote search head applies the role of the user running the search. This service account role facilitates access to the federated provider, nothing more.
  6. Click Save.

Step two: Create a new service account user on the remote Splunk deployment and assign the role to it

The next step in creating a federated provider service account is creating a service account user on the remote deployment. This user is the service account for the federated provider. Assign the remote deployment role you identified or created in the first step to this service account user.

This step is the same whether or not you will have Local Knowledge Objects enabled for your federated provider.

See Create and manage users with Splunk Web, in the Securing the Splunk Platform manual.

  1. On the remote deployment, in Splunk Web, navigate to Settings > Users.
  2. Click New user.
  3. Give the service account user a name, password, and time zone. The name and password will be referenced when you create your federated provider definition.
  4. Give this user the remote deployment role you defined or identified in the previous task.
  5. Deselect the Require password change on first login option.
  6. Click Save.
  7. Save a record of the user name and password for the service account.
    You need these credentials for the Service Account Username and Service Account Password fields when you create the federated provider definition for the remote Splunk platform deployment.

See Define a federated provider.

Additional security for standard mode federated providers: Federated indexes

If you are going to define a remote Splunk platform deployment as a standard mode federated provider, you need to create federated indexes on the federated search head of your local deployment. See Create a federated index.

On your local deployment, you must define additional role-based access control rules that identify the federated indexes to which your users have access. Each federated index on your local deployment maps to a single dataset on a standard mode federated provider, so this practice ensures that specific roles have access only to specific remote datasets.

After you create federated indexes, follow these steps.

  1. On the local deployment, in Splunk Web, navigate to Settings > Roles.
  2. Click the name of a role that is associated with users who run federated searches.
  3. Click 3. Indexes to display the contents of the Indexes tab.
  4. Locate the federated indexes you have defined. All federated index names in the Indexes list begin with federated:.
  5. Click the Included checkbox for a federated index to include search results from that index for this role.

    If Included is not selected for any federated indexes, this role cannot perform federated searches over standard mode federated providers.

  6. (Optional) Deselect the Included checkbox for federated indexes that should not return search results for this role.
  7. (Optional) Click the Default checkbox for a federated index to include search results from that index when a user that holds this role does not specify an index in their search.
  8. To save all of the changes you have made and close the dialog box, click Save.

See Create and manage roles with Splunk Web.

Last modified on 30 November, 2021
PREVIOUS
Migrate from hybrid search to federated search
  NEXT
Determine which knowledge objects are applied to federated searches

This documentation applies to the following versions of Splunk Cloud Platform: 8.2.2109, 8.2.2111


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters