Curl with negotiate to run a search

juniormint — Thu, 27 Feb 2014 17:23:17 GMT

I am interacting with a splunk server using apache to do single sign to the Splunk web UI.

If I go to the following url in a web browser I get signed on and the page loads; which is great.

https://mysplunk.test.com/en-US/app/MyApp/MyDashboard

Using curl I can run something like the following and get my dashboard back; which seems great as well.

curl --negotiate --user a:a https://mysplunk.test.com/en-US/app/MyApp/MyDashboard

I was hoping that the following would also work...but no. Do I just have a simple error, or is this not possible?

curl --negotiate -u a:a https://mysplunk.test.com/servicesNS/admin/search/search/jobs/export -d output_mode=json --data-urlencode search="| eventcount summarize=f index=MyApps_* | stats count by index"

The response I get is

This resource can be found at <a href='https://localhost:8443/en-US/servicesNS/admin/search/search/jobs/export'>https://localhost:8443/en-US/servicesNS/admin/search/search/jobs/export</a>

Re: Curl with negotiate to run a search

juniormint — Thu, 27 Feb 2014 23:28:39 GMT

To be clear...my fail above was trying to access REST API endpoints not available through the web UI.

Not supporting SSO for the REST API seems like a miss to me. Would love to hear peoples thoughts if there are good security reasons for not having it.

http://docs.splunk.com/Documentation/Splunk/6.0.1/Security/HowSplunkSSOworks

"Splunk's SSO implementation supports logging into Splunk via Splunk Web only. Since Splunk SSO relies on cookies to save authentication information, SSO cannot be used for CLI authentication to Splunk. Invoking https://localhost:8089 (or the assigned management port) still requires independent authentication."

topic Re: Curl with negotiate to run a search in Getting Data In

Curl with negotiate to run a search

Re: Curl with negotiate to run a search