topic Re: Problem with REST API in Getting Data In

Problem with REST API

rmorlen — Thu, 24 May 2012 04:33:10 GMT

We have restricted access to Splunk via the REST API. We have created a user where we think we have allowed this capability. Trying the command:

curl -k https://splunkserver:8089/services/auth/login -d username=restuser -d password=password

Get a message that login fails.

The user restuser inherits from the user role and restaccess role.

authorize.conf contains:

[role_restaccess]

importRoles = user

rtSrchJobsQuota = 0

srchIndexesAllowed = *;_*

srchIndexesDefault = *;main

srchJobsQuota = 4

srchMaxTime = 0

rest\_properties\_get = enabled

rest\_apps\_view = enabled

~~~~~~

Any suggestions?

Re: Problem with REST API

araitz — Thu, 24 May 2012 15:47:04 GMT

Sorry, I can't reproduce locally or remotely. Are you sure this isn't an issue where you need to quote or escape characters in the password?

Re: Problem with REST API

fk319 — Fri, 25 May 2012 13:23:05 GMT

I used a different endpoint, this may be of some help:

servicesNS/admin/$app/auth/login

Re: Problem with REST API

ineeman — Thu, 12 Jul 2012 01:45:57 GMT

rmorlen, were you able to resolve this?

Re: Problem with REST API

rmorlen — Fri, 20 Jul 2012 12:35:39 GMT

Yes. The configuration of our environment runs pretty much using Apps. Security is also controlled through an app (including LDAP configuration) with only server specific settings configured locally. We had to coordinate the local settings with the app controlled settings.