How does Splunk DB Connect identity.dat file gets generated?

[mchristopherson]

We are working on automating the installation and configuration of Splunk DB Connect.  For the purposes of this question we are using DB Connect version 3.6.0

My question is how does the identity.dat file get generated.  We know it gets generated on a fresh DB Connect install the first time an identity is created manually.  Our issue is the DB Connect API endpoint for creating identities returns a 200 OK when creating an identity for the first time - but it does not get created and no identity.dat file is generated.

If after a fresh install of DB Connect we manually though the UI add an identity - the identity.dat file is successfully generated.  We are then able to hit the endpoint to create identities and it creates them correctly.

The endpoint that we are hitting is:

/servicesNS/nobody/splunk_app_db_connect/db_connect/dbxproxy/identities

The payload that we are uploading to the endpoint is formatted as such:

    def output(self):
        data = {}
        data["name"] = self.db_identity_name
        data["username"] = self.db_username
        data["password"] = self.db_password
        data["disabled"] = self.disabled
        data["domain_name"] = self.domain_name
        data["use_win_auth"] = self.use_win_auth
        return data

[mchristopherson · Accepted solution]

This file gets auto generated.  It helps if your filesystem level permissions are set correctly so the user and group running splunk own the splunk_app_db_connect directory and sub-directories.  We had an issue with our ansible where these were being set to root:root instead of splunk:splunk.

Once we resolved that issue the indentity.dat file auto generates when splunk starts up.  The 200 OK's were still concerning to get when hitting the API even though no identity was actually created.