topic Re: Users can't send mail after upgrade to 8.0.5 in Splunk Enterprise

Getting error "sendemail:1370": Users can't send mail after upgrade from 7.2.6 to 8.0.5.

netspin — Wed, 02 Sep 2020 22:15:12 GMT

Hi all, after upgrade to 8.0.5 from 7.2.6 all my users can't send mail using sendemail.py because they don't have access to mail settings:

ERROR sendemail:1370 - Could not get email credentials from splunk, using no credentials. Error: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/services/admin/alert_actions/email

I've already checked that list_settings is added to roles. If I add admin_all_objects users can send but I don't want to add that capability to all users.

Is there other capability to add other that list_settings to enable user to send mail?

Thanks

Re: Users can't send mail after upgrade to 8.0.5

thambisetty — Fri, 07 Aug 2020 15:53:06 GMT

Can you try re-entering the password in email settings.

Re: Users can't send mail after upgrade to 8.0.5

netspin — Mon, 10 Aug 2020 06:47:08 GMT

I think credential is correctly stored as if I login using admin mail is working.

The issue is with user without admin priviledge (but with list_settings capabilities).

Thanks

Re: Users can't send mail after upgrade to 8.0.5

mne — Wed, 12 Aug 2020 11:49:41 GMT

I have the same problem. If I add "list_settings" to role user. Then users can send mail, but get an error in python.log:

sendemail:1370 - Could not get email credentials from splunk, using no credentials. Error: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/services/admin/alert_actions/email

Re: Users can't send mail after upgrade to 8.0.5

_smp_ — Tue, 18 Aug 2020 12:49:59 GMT

Me too, in Splunk Cloud.

Re: Users can't send mail after upgrade to 8.0.5

matthewroberson — Tue, 01 Sep 2020 04:39:44 GMT

Same issue here. After upgrading to 8.0.5 alerts that were working, don't work unless i change the owner to an admin user.

Re: Users can't send mail after upgrade to 8.0.5

matthewroberson — Wed, 02 Sep 2020 20:06:21 GMT

I see now that this is a Highlighted Issue in the release notes. Hope they fix it soon...

Re: Getting error "sendemail:1370": Users can't send mail after upgrade from 7.2.6 to 8.0.5.

lakromani — Thu, 03 Sep 2020 05:35:02 GMT

Fixed issue in 8.0.6

2020-08-26

SPL-194243, SPL-193332

After upgrade to version 8.0.5, the splunk user needs the "admin_all_objects" capability to send email alert

Re: Getting error "sendemail:1370": Users can't send mail after upgrade from 7.2.6 to 8.0.5.

apietersen — Wed, 03 Mar 2021 13:19:33 GMT

same here, I am now in version 8.1.2, no solution yet. Reported (again) to support for a final solution.

https://docs.splunk.com/Documentation/Splunk/8.1.2/ReleaseNotes/KnownIssues

In my opnion this is nothing else than a security breach. Security for regular user is "wide open" if you want use this sendemail function. This issue has already a long history in version and the the lack of urgency begins to worry me.

Re: Getting error "sendemail:1370": Users can't send mail after upgrade from 7.2.6 to 8.0.5.

grant_c — Sun, 28 Mar 2021 21:14:31 GMT

I cant find anyone with this issue on version 7.12, but it looks to be slightly different

sendemail:460 - Connection unexpectedly closed while sending mail to:<Email>

this is when you send a test email from the export PDF "send test email" link

2021-03-29 09:25:09,687 +1300 INFO sendemail:1296 - Generated PDF for email
2021-03-29 09:25:15,035 +1300 ERROR sendemail:137 - Sending email. subject="Splunk Dashboard: <Name>", results_link="None", recipients="[u'<User>']", server="smtp.office365.com:587"

When sending as admin It works as I assume that is needs to pass on the creds (which you cant specify when using "send test email" ) and only works when testing it from a Admin account.

We are planning to go to the cloud so updating to the 8.0.6 (so called fixed version) it not on the cards and someone says its an issue in the cloud which i hope was resolved?

any work around for now?

Re: Getting error "sendemail:1370": Users can't send mail after upgrade from 7.2.6 to 8.0.5.

grant_c — Sun, 28 Mar 2021 22:51:05 GMT

NVM I found some interesting information

For a number of version now the requirements are

User role configuration for PDF delivery

The following capabilities are required for PDF delivery scheduling.

schedule_search
admin_all_objects. This capability is required if the mail host requires login credentials.
list_settings

Email notification action - Splunk Documentation

so the only way to "Allow" this is to give a role this capability (rather not) or setup a local SMTP to forward the email to O365

Re: Getting error "sendemail:1370": Users can't send mail after upgrade from 7.2.6 to 8.0.5.

apietersen — Mon, 29 Mar 2021 14:29:46 GMT

FyI: Recent answer from Splunk Support:

Previously mentioned bugs, SPL-194202 being one of them addressed the issue where alerts created by a user with role "user" would not be sent if they didn't have the admin_all_objects capability - this has been fixed. This is different from using the "sendemail" command directly from any search - I'm afraid this is working as documented (it will not work unless the previously discussed capabilities are added to the user role), please see the documentation on that:

https://docs.splunk.com/Documentation/Splunk/latest/Alert/Emailnotification#Define_an_email_notification_action_for_an_alert_or_scheduled_report

https://docs.splunk.com/Documentation/Splunk/latest/Alert/Emailnotification#User_role_configuration_for_PDF_delivery (https://docs.splunk.com/Documentation/Splunk/8.1.3/Alert/Emailnotification#User_role_configuration_for_PDF_delivery)

If you are sending an email notification to a server that requires SMTP authentication, you must have the admin role assigned. (https://docs.splunk.com/Documentation/Splunk/latest/Alert/Emailnotification#Use_a_search_command_to_... (truncated, see original email for full text)

Conclusion: this will not be fixed in any version because it works as documented 😞

Re: Getting error "sendemail:1370": Users can't send mail after upgrade from 7.2.6 to 8.0.5.

apietersen — Mon, 29 Mar 2021 14:43:55 GMT

created an Idea on:

sole the issue: sendemail without the cost of a security | Ideas (splunk.com)

unfortunately I have only 1 Votes yet 🙂 - so a solution soon is not expected

Re: Users can't send mail after upgrade to 8.0.5

w531t4 — Fri, 02 Jul 2021 15:28:09 GMT

we're experiencing this issue, too? Did you find a fix?

Re: Users can't send mail after upgrade to 8.0.5

matthewroberson — Fri, 02 Jul 2021 16:49:17 GMT

We upgraded to 8.0.6 and that resolved the issue.

Re: Users can't send mail after upgrade to 8.0.5

apietersen — Sun, 04 Jul 2021 08:30:50 GMT

I created an idea some time ago for this issue, see

sole the issue: sendemail without the cost of a security | Ideas (splunk.com)

It appears to be in a stage of consideration.