All Apps and Add-ons

How does Splunk DB Connect identity.dat file gets generated?

mchristopherson
Explorer

We are working on automating the installation and configuration of Splunk DB Connect.  For the purposes of this question we are using DB Connect version 3.6.0

My question is how does the identity.dat file get generated.  We know it gets generated on a fresh DB Connect install the first time an identity is created manually.  Our issue is the DB Connect API endpoint for creating identities returns a 200 OK when creating an identity for the first time - but it does not get created and no identity.dat file is generated.

If after a fresh install of DB Connect we manually though the UI add an identity - the identity.dat file is successfully generated.  We are then able to hit the endpoint to create identities and it creates them correctly.

The endpoint that we are hitting is:

 

/servicesNS/nobody/splunk_app_db_connect/db_connect/dbxproxy/identities

 

The payload that we are uploading to the endpoint is formatted as such:

 

    def output(self):
        data = {}
        data["name"] = self.db_identity_name
        data["username"] = self.db_username
        data["password"] = self.db_password
        data["disabled"] = self.disabled
        data["domain_name"] = self.domain_name
        data["use_win_auth"] = self.use_win_auth
        return data

 

Labels (2)
1 Solution

mchristopherson
Explorer

This file gets auto generated.  It helps if your filesystem level permissions are set correctly so the user and group running splunk own the splunk_app_db_connect directory and sub-directories.  We had an issue with our ansible where these were being set to root:root instead of splunk:splunk.

Once we resolved that issue the indentity.dat file auto generates when splunk starts up.  The 200 OK's were still concerning to get when hitting the API even though no identity was actually created.

View solution in original post

0 Karma

mchristopherson
Explorer

This file gets auto generated.  It helps if your filesystem level permissions are set correctly so the user and group running splunk own the splunk_app_db_connect directory and sub-directories.  We had an issue with our ansible where these were being set to root:root instead of splunk:splunk.

Once we resolved that issue the indentity.dat file auto generates when splunk starts up.  The 200 OK's were still concerning to get when hitting the API even though no identity was actually created.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...