All Apps and Add-ons

Getting error AuthorizationFailed: [HTTP 403] Client is not authorized to perform requested action

Dev_Choudhary
Path Finder

Hi Team,
We have configuring Symantec ATP Add-on to receive Symantec ATP logs on Splunk.
We have defined App as ATP and got the Client ID and Client Secret on ATP manager (HTTP event collector already configured), when we are configuring add-on on Splunk HF we are successfully able to authenticate from Symantec ATP.
alt text

When searching the logs on Search Head with query sourcetype = Symantec* getting below error

ERROR 140385235900224 - Symantec ATP Manager: Exception while getting ATP manager host
Traceback (most recent call last):
File "/opt/splunk/etc/apps/TA-symantec_atp/bin/atp_manager_utility.py", line 110, in get_atp_manager_user_credentials
sessionKey=session_key)
File "/opt/splunk/lib/python2.7/site-packages/splunk/entity.py", line 129, in getEntities
atomFeed = getEntitiesAtomFeed(entityPath, namespace, owner, search, count, offset, sort_key, sort_dir, sessionKey, uri, hostPath, **kwargs)
File "/opt/splunk/lib/python2.7/site-packages/splunk/entity.py", line 222, in _getEntitiesAtomFeed
serverResponse, serverContent = rest.simpleRequest(uri, getargs=kwargs, sessionKey=sessionKey, raiseAllErrors=True)
File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/
init_.py", line 516, in simpleRequest
raise splunk.AuthorizationFailed(extendedMessages=uri)
AuthorizationFailed: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/servicesNS/nobody/TA-symantec_atp/storage/passwords?count=-1&search=TA-symant...

Thanks in Advance

0 Karma
1 Solution

Dev_Choudhary
Path Finder

Hi

Issue is resolved now. Two possible issues from ATP manager that I can highlights are

  1. OAuth Client name should be ATP
  2. Time range should be latest (like last 2 month), default it was taking something from 1990

View solution in original post

0 Karma

Dev_Choudhary
Path Finder

Hi

Issue is resolved now. Two possible issues from ATP manager that I can highlights are

  1. OAuth Client name should be ATP
  2. Time range should be latest (like last 2 month), default it was taking something from 1990

View solution in original post

0 Karma

ArchanaC
New Member

Hi Dev_Choudhary,

Is your issue resolved?
If your issue is resolved, can you share the cause/resolution with us?

If you are still facing the issue can you provide the answers to below questions:
1. What Addon version you are using?
2. Have you changed any access rights of existing roles like admin/user/power/splunk-system-role?
3. Can you access Splunk management port URL from the browser with admin credentials? (example: https://:8089)
4. Also, can you post the contents of Addon's inputs.conf of local? (If any sensitive information is there you can asterisk it before posting.)

Thanks,
Archana

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!