Unable to save playbooks for users with granular label permissions in Splunk SOAR 8.7
Available Languages
Applicability
Splunk SOAR CloudDescription
A regression introduced in Splunk SOAR 8.7 affects playbook save authorization for users with restricted or granular label permissions.
When a user attempts to save an Input Playbook (which operates globally by default) or an Automation Playbook set to operate on * (all labels), the backend checks if the user has explicit permission for the * label. Because role management enumerates existing labels rather than granting wildcard access, the check fails even if "Select All" labels was selected on the role.
Affected Versions: Splunk SOAR 8.7.x (worked as expected in 8.6.x)
Another side effect of this bug is, when the user is an automation user, it will not trigger PBs on containers that are expected to have a PB ran on them
Investigation
To determine whether an environment is encountering this issue, verify the following:
User Role Configuration: The affected user has a non-admin role configured with granular label permissions under Administration > User Management > Roles.
Triggering Action: The user attempts to create or save:
Any Input Playbook.
An Automation Playbook with the OPERATES ON field set to *.
Observed Error: The SOAR UI displays the following error banner upon saving:
User "<username>" with id "<user_id>" does not have edit access to the ['*'] label(s)Resolution
Permanent Fix
A code fix to make label authorization playbook-type aware and properly handle wildcard validation is scheduled for Splunk SOAR 8.8 (subject to change).
Temporary Workaround
Create a literal * label using the REST API (the web UI restricts special characters) and assign permissions for that label to the affected roles.
Create the * label via REST API:
Run the following curl command using an administrator account:
curl -k -u <admin_username>:<admin_password> \
-X POST https://<soar_host>:<port>/rest/system_settings/events \
-H "Content-Type: application/json" \
-d '{"add_label": true, "label_name": "*"}'
Grant Role Permissions:
Navigate to Administration > User Management > Roles.
Select and edit the role assigned to the affected users.
Under the Labels permission section, locate the new * label and grant the required permissions (View/Edit).
Save the role configuration.
Post-Upgrade Cleanup:
Once your environment has been upgraded to Splunk SOAR version 8.8 (or the patch containing the fix is applied), delete the * label as it will no longer be required.
Revision History
| Revision | Publish Date | Comments |
|---|---|---|
1.0 |
01-Oct-2026
|
Initial Release |
Feedback