Is it possible to use TLS client certs to connect to Splunk REST API?

vinzentalves — Wed, 17 Jun 2020 22:40:16 GMT

I need to use TLS client certs to connect to Splunk REST API.

It seems this is not possible out of the box with client.connet() as per the docs here: docs.splunk.com/DocumentationStatic/PythonSDK/1.6.5/client.html#splunklib.client.connect - there is no cert/key param.

Is it somehow possible to use TLS client certs with the Splunk Python SDK ?

Re: TLS client certs and the Splunk Python SDK

harsmarvania57 — Fri, 16 Aug 2019 14:02:53 GMT

Hi,

You can achieve this using splunklib.six module. Below is sample script which connects to splunk server and retrieve sessionKey and then you can use that session_key to do other work in same script.

import sys
sys.path.append('splunk-sdk-python-1.6.5')
import splunklib.six as six
import urllib
from xml.etree import ElementTree
import getpass

HOST = raw_input("Enter splunk server hostname/ip: ")
PORT = 8089

splunkUser = raw_input("Enter Splunk Username: ")
splunkPassword = getpass.getpass("Enter Password: ")

connection = six.moves.http_client.HTTPSConnection(HOST, PORT)
body = urllib.urlencode({'username': splunkUser, 'password': splunkPassword})
headers = {'Content-Type': "application/x-www-form-urlencoded",
           'Host': HOST
          }

connection.request("POST", "/services/auth/login", body, headers)
response = connection.getresponse()
content = response.read()
connection.close()

session_key = ElementTree.XML(content).findtext("./sessionKey")

As per my knowledge (I am not at advanced level of python) in above script six.moves.http_client.HTTPSConnection is using httplib module which has key_file and cert_file parameter so you can use those parameter for TLS connections.

Help on class HTTPSConnection in splunklib.six.moves.http_client:

splunklib.six.moves.http_client.HTTPSConnection = class HTTPSConnection(HTTPConnection)
 |  This class allows communication via SSL.
 |
 |  Methods defined here:
 |
 |  __init__(self, host, port=None, key_file=None, cert_file=None, strict=None, timeout=<object object>, source_address=None, context=None, check_hostname=None)
 |
 |  connect(self)
 |      Connect to a host on a given (SSL) port.
 |

topic Is it possible to use TLS client certs to connect to Splunk REST API? in Splunk Dev

Is it possible to use TLS client certs to connect to Splunk REST API?

Re: TLS client certs and the Splunk Python SDK