topic Re: Need help on the splunk.entity.getEntities in Splunk Dev

Need help on the splunk.entity.getEntities

mbachhav — Wed, 06 Oct 2021 04:30:54 GMT

We have TA for Splunk and are using Splunk's internal library(splunk.entity) to fetch the credentials from passwords.conf file using the below code.

On some Splunk enterprise instances below code is working properly and returning username and clear password. But on some Splunk enterprise instances and Splunk cloud, it has been observed that the value of ['eai:acl']['app'] is Null due to which exception has been raised by the code.

We would like to know why some Splunk instances return the Null value for ['eai:acl']['app'].

Code -

import splunk.entity as entity

myapp = 'APP-NAME'

realm = 'APP-NAME-Api'

try:

entities = entity.getEntities(['admin', 'passwords'], namespace=myapp, owner='nobody', sessionKey=session_key)

except Exception as e:

raise Exception("Could not get %s credentials from Splunk. Error: %s" % (myapp, str(e)))

for i, c in list(entities.items()):

if c['eai:acl']['app'] == myapp and c['realm'] == realm:

return c['username'], c['clear_password']

raise Exception("No credentials found.")

We also tried with the below CURL command but the field ['eai:acl']['app'] is missing in the response.

curl -k -u <splunk_username>:<splunk_password> https://<host>:8089/services/storage/passwords

Re: Need help on the splunk.entity.getEntities

kamlesh_vaghela — Sat, 09 Oct 2021 14:33:25 GMT

@mbachhav

Does the user have appropriate capabilities to access password?

users require the list_storage_passwords capability to read plain text secrets and the admin_all_objects capability to create, update, and delete secrets.

Thanks
KV
▄︻̷̿┻̿═━一 😉

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: Need help on the splunk.entity.getEntities

mbachhav — Thu, 21 Oct 2021 07:21:19 GMT

@kamlesh_vaghela ,

Yes, a user has capabilities to access passwords and access to list_storage_passwords and admin_all_objects capabilities.