Got error after installation: OOOOPS - UNAUTHORIZED

[ww9rivers]

Under that subject line, the detail says:

You do not have necessary authorization to access and use this application : App Content Manager.

Access to all of its features has been restricted.

If you believe this is in error, or if you require access for a specific reason, please reach out to your Splunk administrator for further assistance.

But I am the Splunk Admin.

This app is quite new and not supported by Splunk. So I am trying to get the authors' insights or anyone who has experiences with it. Much appreciated!

[ww9rivers]

Thank you, @akouki_splunk! That's it. The on-prem Splunk instance uses SAML authentication so I get automatically assigned both "admin" and "user" roles from my group memberships. The "user" role was in the "blacklisted_roles" list, which caused the error.

Thank you for the quick response!

[akouki_splunk · Accepted solution]

Hi @ww9rivers ,

I'm @akouki_splunk , the developer of the Content Manager App.
It seems you are having an issue with the blacklisted roles or users.
Do you have access to the app configuration files?
If so, please open the etc/apps/appcontentmanager/default/acms_settings.conf file and clear the blacklisted_roles and blacklisted_users attributes.
The file content should look like this after the modification :

[settings]
blacklisted_apps = alert_logevent,alert_webhook,appsbrowser,introspection_generator_addon,launcher,learned,legacy,logd_input,python_upgrade_readiness_app,sample_app,splunk_assist,splunk_gdi,splunk_httpinput,splunk_ingest_actions,splunk_instrumentation,splunk_internal_metrics,splunk_metrics_workspace,splunk_monitoring_console,splunk_secure_gateway,SplunkForwarder,SplunkLightForwarder,splunk-dashboard-studio
blacklisted_conffiles = server,limits,app,passwords
blacklisted_stanzas = 
blacklisted_roles =
blacklisted_users = 
theme = light
is_configured = 0
default_owner = nobody

[inventsekar]

Hi @ww9rivers .. i hope you have the problem with the Splunk App (Content Manager App for Splunk) installation (not with the Splunk installation).

Are you using Splunk on linux or windows or mac. 

may we know how did you install that app.. 

[ww9rivers]

Sorry for missing the details ...

The message came from the app, not Splunk itself.

Splunk itself is a standalone instance, version 8.1.5, running on a RHEL 8.10 Linux VM. I downloaded the package from Splunkbase and installed it with "install app from file".

Thank you for taking the time!