topic Re: How to disable token using REST API? in Splunk Enterprise

How to disable token using REST API?

ropo — Wed, 03 Jan 2024 08:35:16 GMT

Hello,

I do success to disable/enable tokens using the WEB interface.

But curl command fails while trying to disable token using REST API.

Executing GET method works OK:

curl -k -u USER1:USER_PASW -X GET https://localhost:8089/services/authorization/tokens -d id=80e7402b9940a7ac761f259d1e3e49bad1417394924ad0909c8edfd8eb92800e

But PUT is failed with no clear error message:

curl -k -u USER1:USER_PASW -X PUT https://localhost:8089/services/authorization/token/ron -d id=80e7402b9940a7ac761f259d1e3e49bad1417394924ad0909c8edfd8eb92800e -d status=disabled

The result is:

<?xml version="1.0" encoding="UTF-8"?>
<response>
<messages>
<msg type="ERROR">Not Found</msg>
</messages>
</response>

I tried to switch username between ron and david.

What's wrong and how to locate more informative problem description.

Thanks in advance,

David

Re: How to disable token using REST API?

tej57 — Wed, 03 Jan 2024 10:28:34 GMT

Hello @ropo ,

I guess just the method that you've provided seems to be inappropriate. You'll need to use the POST method to disable the authentication token.

Example:

curl -k -u <username>:<password> -X POST https://<server>:<management_port>/services/authorization/tokens/<token_user> -d id=<token_id> -d status=disabled

Reference Doc - https://docs.splunk.com/Documentation/Splunk/9.1.2/Security/ManageAuthTokens#Disable_an_existing.2C_enabled_token

---
If the above solution helps, an upvote is appreciated.

Re: How to disable token using REST API?

ropo — Wed, 03 Jan 2024 12:11:17 GMT

Actually, the POST is only one problem, I have already gone through.

Thanks to your post has found syntax error - "/token/" instead of "/tokens/"