topic installation using rpm - authorization in Splunk SOAR

installation using rpm - authorization

kwells0479 — Wed, 30 Sep 2020 04:06:08 GMT

We have been working on getting an installation of phantom running in a centos:7 docker container using rpm, but are experiencing some issues around authentication following the steps outlined here:

https://docs.splunk.com/Documentation/Phantom/4.8/Install/InstallRPM

We cannot authenticate when running the install script, in the docker container or even locally. Our team has taken a look at phantom_setup.sh and have tried passing our splunk phantom community credentials in simple requests to the phantom repo, for example: wget https://USER:PW@repo.phantom.us/phantom/4.8/product/x86_64/repodata/repomd.xml (this example is just a test to confirm), but all tests have resulted in failed authentication. Is anyone else experiencing this issue?

Re: installation using rpm - authorization

vikramyadav — Thu, 13 Feb 2020 17:26:52 GMT

Refer this
https://my.phantom.us/4.6/docs/installation/rpm#InstallFromRPM

Re: installation using rpm - authorization

kwells0479 — Thu, 13 Feb 2020 17:46:15 GMT

As stated above, we have been following that documentation:

https://docs.splunk.com/Documentation/Phantom/4.8/Install/InstallRPM

Only for version 4.8. Do you believe this issue is version specific?

Re: installation using rpm - authorization

vikramyadav — Thu, 13 Feb 2020 17:49:56 GMT

Yeah. It might be a version. Because I also had install phantom in my organization and I was successfully able to install. Try to install an older version.

Re: installation using rpm - authorization

kwells0479 — Thu, 13 Feb 2020 20:56:30 GMT

After back and forth trying to verify, this morning we realized there seems to have been a bug with the phantom community login authentication. Yesterday Both myself and another developer were able to login to https://my.phantom.us/ with the user id used to log into: https://login.splunk.com. This morning we tried the same process and were prompted to login using our associated email account for the login user. This bug confused as about which set of credentials we were supposed to be using, hopefully it was fixed.