topic How to make REST API call with modular data inputs for Certificate and Key based authentication? in Getting Data In

How to make REST API call with modular data inputs for Certificate and Key based authentication?

21Sharma — Mon, 01 Apr 2024 09:11:22 GMT

I am trying to call a 3rd party API which supports Certificate and Key based authentication. I have an on-prem instance of Splunk (Version: 9.0.2) running on a VM. I have verified the API response on the VM via curl command (Command used: curl --cert <"path to .crt file"> --key <"path to .key file"> --header "Authorization: <token>" --request GET <"url">) which gives response for a normal user. However, when running the same curl command using shell in Splunk Add-on Builder's Modular Data Inputs, the command only works with "sudo" otherwise it gives Error 403. When checked with "whoami", it returns the user as root.

Question 1:

Why is the curl command not working without using sudo even when the user is root. Is there any configuration that I need to modify to make it work without using sudo.

Question 2:

How do I make the same API call using Python code in Modular Data Inputs of Splunk Add-on Builder.

Re: How to make REST API call with modular data inputs for Certificate and Key based authentication?

PickleRick — Mon, 01 Apr 2024 09:43:10 GMT

1. Run curl with -v to see its operation verbosely. Most probably you're trying to read cryptographic material from a directory you don't have access to.

2. In order to use client certificates you can do it like this:

https://requests.readthedocs.io/en/latest/user/advanced/#client-side-certificates

Re: How to make REST API call with modular data inputs for Certificate and Key based authentication?

21Sharma — Mon, 01 Apr 2024 11:26:09 GMT

Thank you for your response @PickleRick. I tried running curl in verbose mode. After successful connection to proxy, I am getting below error but am unable to locate squid.conf file.

X-Squid-Error: ERR_ACCESS_DENIED 0

Re: How to make REST API call with modular data inputs for Certificate and Key based authentication?

PickleRick — Mon, 01 Apr 2024 12:56:13 GMT

Squid is not part of Splunk Enterprise installation. So if you're hitting squid it means either it is working as a reverse-proxy for your target service or you connect to it in order to perform the outbound connection.

Also - if your proxy is doing TLS inspection, cert-based mutual authentication won't work unless you create an exception in your inspection policy.