Rapid7 Nexpose Technology Add-On for Splunk: How to resolve "Authentication failed for tenant admin and user nexpose_password" error message?

[jtrujillo]

I am seeing this error from the system. I have tested this user, and password combination, and it works fine in Rapid7.

WARNING: Athentication failed for tenant admin and user nexpose_password
Info: No JSON object could be decoded

Here are the contents of my conf files. BTW I am using OSX. ... one thing that stands out is that "password = admin" ... which is definitely not the case.

LP-$-OSX:local $ more nexpose_details.conf 
[setupentity]
hostname = https://rapid7-console.usw1.XXX.cloud
import_solution = 1
new_scans_only = 0
password = admin
username = splunk_addon
LP-$-OSX:local $ more passwords.conf 
[credential::nexpose_password:]
password = <some hash>==

[splk]

What I suggest to trace the error down:

1. recheck if the credentials (user / password) are working and have the correct permissions
2. reinstall the add-on, make sure no other rapid7 add-on / app is installed (we notice some problems with old installations, despite the fact the app was deactivated)
3. contact rapid7 splunk support: support@rapid7.com

Kind regards

[jtrujillo]

Here are some more logs from splunkd.log

02-15-2017 11:26:52.160 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/instances_stats.py" Traceback (most recent call last):
02-15-2017 11:26:52.174 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/instances_stats.py"   File "/Applications/Splunk/etc/apps/openstack_app/bin/api/instances_stats.py", line 54, in <module>
02-15-2017 11:26:52.200 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/instances_stats.py"     main()
02-15-2017 11:26:52.205 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/instances_stats.py"   File "/Applications/Splunk/etc/apps/openstack_app/bin/api/instances_stats.py", line 32, in main
02-15-2017 11:26:52.226 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/instances_stats.py"     auth_token,auth_services = login(user_name,password)
02-15-2017 11:26:52.231 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/instances_stats.py"   File "/Applications/Splunk/etc/apps/openstack_app/bin/api/authentication.py", line 51, in login
02-15-2017 11:26:52.264 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/instances_stats.py"     return auth_token,auth_response_body
02-15-2017 11:26:52.286 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/instances_stats.py" UnboundLocalError: local variable 'auth_response_body' referenced before assignment
02-15-2017 11:26:52.513 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/networks_stats.py" Traceback (most recent call last):
02-15-2017 11:26:52.518 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/networks_stats.py"   File "/Applications/Splunk/etc/apps/openstack_app/bin/api/networks_stats.py", line 41, in <module>
02-15-2017 11:26:52.522 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/networks_stats.py"     main()
02-15-2017 11:26:52.525 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/networks_stats.py"   File "/Applications/Splunk/etc/apps/openstack_app/bin/api/networks_stats.py", line 29, in main
02-15-2017 11:26:52.526 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/networks_stats.py"     auth_token,auth_services = login(user_name,password)
02-15-2017 11:26:52.527 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/networks_stats.py"   File "/Applications/Splunk/etc/apps/openstack_app/bin/api/authentication.py", line 51, in login
02-15-2017 11:26:52.531 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/networks_stats.py"     return auth_token,auth_response_body
02-15-2017 11:26:52.534 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/networks_stats.py" UnboundLocalError: local variable 'auth_response_body' referenced before assignment
02-15-2017 11:26:52.598 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/services_info.py" Traceback (most recent call last):
02-15-2017 11:26:52.600 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/services_info.py"   File "/Applications/Splunk/etc/apps/openstack_app/bin/api/services_info.py", line 43, in <module>
02-15-2017 11:26:52.601 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/services_info.py"     main()
02-15-2017 11:26:52.603 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/services_info.py"   File "/Applications/Splunk/etc/apps/openstack_app/bin/api/services_info.py", line 31, in main
02-15-2017 11:26:52.605 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/services_info.py"     auth_token,auth_services = login(user_name,password)
02-15-2017 11:26:52.606 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/services_info.py"   File "/Applications/Splunk/etc/apps/openstack_app/bin/api/authentication.py", line 51, in login
02-15-2017 11:26:52.607 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/services_info.py"     return auth_token,auth_response_body
02-15-2017 11:26:52.609 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/services_info.py" UnboundLocalError: local variable 'auth_response_body' referenced before assignment
02-15-2017 11:26:52.617 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/volumes_info.py" Traceback (most recent call last):
02-15-2017 11:26:52.628 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/volumes_info.py"   File "/Applications/Splunk/etc/apps/openstack_app/bin/api/volumes_info.py", line 43, in <module>
02-15-2017 11:26:52.629 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/volumes_info.py"     main()
02-15-2017 11:26:52.630 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/volumes_info.py"   File "/Applications/Splunk/etc/apps/openstack_app/bin/api/volumes_info.py", line 31, in main
02-15-2017 11:26:52.632 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/volumes_info.py"     auth_token,auth_services = login(user_name,password)
02-15-2017 11:26:52.634 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/volumes_info.py"   File "/Applications/Splunk/etc/apps/openstack_app/bin/api/authentication.py", line 51, in login
02-15-2017 11:26:52.635 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/volumes_info.py"     return auth_token,auth_response_body
02-15-2017 11:26:52.636 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/volumes_info.py" UnboundLocalError: local variable 'auth_response_body' referenced before assignment
02-15-2017 11:26:52.699 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/routers_stats.py" Traceback (most recent call last):
02-15-2017 11:26:52.701 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/routers_stats.py"   File "/Applications/Splunk/etc/apps/openstack_app/bin/api/routers_stats.py", line 47, in <module>
02-15-2017 11:26:52.702 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/routers_stats.py"     main()
02-15-2017 11:26:52.703 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/routers_stats.py"   File "/Applications/Splunk/etc/apps/openstack_app/bin/api/routers_stats.py", line 31, in main
02-15-2017 11:26:52.704 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/routers_stats.py"     auth_token,auth_services = login(user_name,password)
02-15-2017 11:26:52.706 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/routers_stats.py"   File "/Applications/Splunk/etc/apps/openstack_app/bin/api/authentication.py", line 51, in login
02-15-2017 11:26:52.709 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/routers_stats.py"     return auth_token,auth_response_body
02-15-2017 11:26:52.743 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/routers_stats.py" UnboundLocalError: local variable 'auth_response_body' referenced before assignment

[jtrujillo]

Couple more log tails

LP-$-OSX:splunk $ tail -10 TA-rapid7_nexpose.log 
2017-02-15 11:27:06,350 INFO    nx_logger:38 - Saving changes made on configuration screen...
2017-02-15 11:27:06,569 INFO    nx_logger:38 - Sucessfully retrieved stored config for Nexpose.
2017-02-15 11:27:06,643 INFO    nx_logger:38 - Password retrieved.
2017-02-15 11:27:07,637 INFO    nx_logger:38 - Executing nexpose_setup.py
2017-02-15 11:27:07,637 INFO    nx_logger:38 - Listing the fields for the set up screen...
2017-02-15 11:27:08,843 INFO    nx_logger:38 - Executing nexpose_setup.py
2017-02-15 11:27:09,676 INFO    nx_logger:38 - Executing nexpose_setup.py
2017-02-15 11:27:09,677 INFO    nx_logger:38 - Listing the fields for the set up screen...
2017-02-15 11:27:10,892 INFO    nx_logger:38 - Executing nexpose_setup.py
2017-02-15 11:27:11,801 INFO    nx_logger:38 - Executing nexpose_setup.py



LP-$-OSX:splunk $ tail -10 rapid7.log 
2017-01-30 10:58:40,811 INFO    nexpose_setup:34 - Executing nexpose_setup.py
2017-01-30 10:58:41,498 INFO    nexpose_setup:34 - Executing nexpose_setup.py
2017-01-30 11:14:15,597 INFO    __init__:168 - Using default logging config file: /Applications/Splunk/etc/log.cfg
2017-01-30 11:14:15,601 INFO    __init__:206 - Setting logger=splunk level=INFO
2017-01-30 11:14:15,602 INFO    __init__:206 - Setting logger=splunk.appserver level=INFO
2017-01-30 11:14:15,603 INFO    __init__:206 - Setting logger=splunk.appserver.controllers level=INFO
2017-01-30 11:14:15,603 INFO    __init__:206 - Setting logger=splunk.appserver.controllers.proxy level=INFO
2017-01-30 11:14:15,605 INFO    __init__:206 - Setting logger=splunk.appserver.lib level=WARN
2017-01-30 11:14:15,605 INFO    __init__:206 - Setting logger=splunk.pdfgen level=INFO
2017-01-30 11:14:15,606 INFO    setup:29 - Executing setup.py