All Apps and Add-ons

Splunk Add-on for Micsrosoft Cloud Services: Unable to the auto-generated certificate. Is the JSON file corrupt?

craigrichardvrt
Path Finder

Tried using my own cert, but didn't work so I thought I would try to use the auto-generated option instead. I got the JSON file, but when I went to merge it, and followed the steps to remove the extra characters, Microsoft rejected the Manifest from being uploaded.

As a test, I downloaded the manifest and uploaded it right back in without an issue, so there's definitely something wrong with the JSON output.

This is the error Microsoft is generating (along with a ton of data):

Invalid array passed in, ',' expected. (367):

Thanks

0 Karma

pkiripolsky
Path Finder

I had a similar issue. Turns out that at the end of the JSON supplied by the TA, it was missing a ,. It should look like this:

....  
  ],
  "keyCredentials": [
    {
      "usage": "Verify",
      "keyId": "yourkeyidhere",
      "value": "youvaluehere",
      "customKeyIdentifier": "yourcustomKeyhere",
      "type": "AsymmetricX509Cert"
    }
  ]**,** <------------Notice the ","
....

But instead, the TA returns it like this:

....  
  ],
  "keyCredentials": [
    {
      "usage": "Verify",
      "keyId": "yourkeyidhere",
      "value": "youvaluehere",
      "customKeyIdentifier": "yourcustomKeyhere",
      "type": "AsymmetricX509Cert"
    }
  ]
....

I changed that and it accepted my JSON file.

0 Karma

gpatzlaff_splun
Splunk Employee
Splunk Employee

When copying the auto generated key credentials, make sure to replace everything between the two commas surrounding the key credentials section in the manifest. If still in doubt use a JSON editor to check your JSON.

craigrichardvrt
Path Finder

Thanks, I ran it through a JSON editor and got this error

Error: Parse error on line 12:
...customKeyIdentifier.....Expecting EOF, }, | got "

When I look at the line, it starts like this (the wif...replaced the real identifier):

keyCredentials": ["customKeyIdentifier": "wifwifnwfnwfnwdfwdf", "keyId": "112121212212".....
0 Karma

gpatzlaff_splun
Splunk Employee
Splunk Employee

You're missing the opening ". It should start with
"keyCredentials": [{"customKeyIdentifier" ...
and end with
... ", "keyId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"}]

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...