All Apps and Add-ons

REST API Modular - trouble passing token header

sam_
Engager

Hiya,

I'm attempting to write a custom authentication handler for the REST API Modular Input addon.

The authentication handler needs to login to a logon endpoint and get a userToken before issuing any  API POST calls.

Screenshot - Data Input Example

exmaple.jpg

At the moment my custom authentication handler looks as follows:

 

from requests.auth import AuthBase
import hmac
import base64
import hashlib
import requests,json

class CustAuthHandler(AuthBase):
    def __init__(self, **args):
        self.username = args['username']
        self.password = args['password']
        self.auth_url = args['auth_url']
        pass

    def __call__(self,r):
        # perform authorization
        payload = {'username': self.username,'password':self.password}
        # Login to Logon endpoint
        auth_response = requests.post(self.auth_url,data=payload)
        # Save response
        response_json = json.loads(auth_response.text)
        # Set userToken variable
        userToken = response_json['userToken']

        # set header
        headers = headers = {'Authorization': 'Bearer ' + userToken}
        r.headers = headers
        return r

 

 

I have successfully tested the sample endpoint by manually providing the Authorization: Bearer token in the HTTP header properties to ensure I can ingest data into Splunk.

I have tried turning Debug mode on, however the  restmodinput_app_modularinput.log only shows the following

sam__0-1622781143131.png

Although the above looks okay, when I check the source I can't see any ingested data

Any help appreciated 🙂

Labels (3)
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...