topic Re: Why am I receiving a 401 "Unauthorized" error for all queries via Java API? in Security

Why am I receiving a 401 "Unauthorized" error for all queries via Java API?

tdhealy — Mon, 08 May 2017 15:36:48 GMT

Using Java 8 with Splunk 6.5.3, attempting to connect with Java API to get a service object. Using the same username and password I can connect with a browser and run queries normally. I suspect an SSL / https handler issue since the return from service has a token but the value for httpHandler is null. I do not know how to approach it.

I currently have:

loginArgs.setSSLSecurityProtocol(SSLSecurityProtocol.TLSv1_2);

Any suggestions very much appreciated.
Thanks

Re: Why am I receiving a 401 "Unauthorized" error for all queries via Java API?

randyabeyta — Mon, 08 May 2017 17:18:06 GMT

This seems to be a known issue with Java 8:

http://dev.splunk.com/view/java-sdk/SP-CAAAEUV

It may be that you need to tie in the security protocol with the service, and not your login args. In the above documentation, it links to this test class:

https://github.com/splunk/splunk-sdk-java/blob/develop/examples/com/splunk/examples/ssl_protocols/Program.java

Re: Why am I receiving a 401 "Unauthorized" error for all queries via Java API?

tdhealy — Mon, 08 May 2017 18:34:03 GMT

Thanks for your help Randy. I had found that Program.java yesterday after Googling my ass off, but it had failed too. So I revisited it and found that the SDK Command parser was corrupting my password string by dropping one character. So I used ServiceArgs to tray an alternative and all the connections now worked! The connection part is shown below.

public SplunkNAT(Properties pr) {

    props = pr;
    errLog = Utils.initLogging(props);

    ServiceArgs loginArgs = new ServiceArgs();
    loginArgs.setUsername(user);
    loginArgs.setPassword(auth);
    loginArgs.setHost(host);
    loginArgs.setPort(port);
    loginArgs.setScheme("https");
    loginArgs.setSSLSecurityProtocol(SSLSecurityProtocol.TLSv1_2);

    System.out.println("Now trying to connect to Splunk using TLSv1.2");
    try {
        Service.setSslSecurityProtocol(SSLSecurityProtocol.TLSv1_2);
        service = Service.connect(loginArgs);
        service.login();
        System.out.println("\t Success!");

    } catch (RuntimeException re) {
        errLog.severe("Unable to make Splunk Service: " + re.getMessage()
                + ExceptionUtils.getStackTrace(re));
    }
    System.out.println("Installed apps: " + service.getApplications().keySet());
}

-Terry