All Apps and Add-ons

error when executing samlpull command

sylbaea
Communicator

I installed your app on a SHC with SAML (ADFS) configured.

When executing | samlpull, I get an error. Inside log, I see:

11-15-2019 09:23:26.615 ERROR ScriptRunner - stderr from '.../splunk/bin/python .../splunk/etc/apps/nhsd_all_prod_sh_adhoc_samlmanager/bin/saml-pull.py':  Traceback (most recent call last):
11-15-2019 09:23:26.615 ERROR ScriptRunner - stderr from '.../splunk/bin/python .../splunk/etc/apps/nhsd_all_prod_sh_adhoc_samlmanager/bin/saml-pull.py':    File ".../splunk/etc/apps/nhsd_all_prod_sh_adhoc_samlmanager/bin/saml-pull.py", line 33, in <module>
11-15-2019 09:23:26.615 ERROR ScriptRunner - stderr from '.../splunk/bin/python .../splunk/etc/apps/nhsd_all_prod_sh_adhoc_samlmanager/bin/saml-pull.py':      expected_saml_groups = saml_utils.pull_remote_saml()
11-15-2019 09:23:26.615 ERROR ScriptRunner - stderr from '.../splunk/bin/python .../splunk/etc/apps/nhsd_all_prod_sh_adhoc_samlmanager/bin/saml-pull.py':    File ".../splunk/etc/apps/nhsd_all_prod_sh_adhoc_samlmanager/bin/saml_utils.py", line 47, in pull_remote_saml
11-15-2019 09:23:26.615 ERROR ScriptRunner - stderr from '.../splunk/bin/python .../splunk/etc/apps/nhsd_all_prod_sh_adhoc_samlmanager/bin/saml-pull.py':      if not authorization_conf_url.startswith("https"):
11-15-2019 09:23:26.615 ERROR ScriptRunner - stderr from '.../splunk/bin/python .../splunk/etc/apps/nhsd_all_prod_sh_adhoc_samlmanager/bin/saml-pull.py':  AttributeError: 'NoneType' object has no attribute 'startswith'
0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @sylbaea
It looks like you havent configured the app to point to an authentication.conf file with your intended SAML roles in.
I'll be writing better documentation for this over the coming weeks, however in the meantime:

Navigate to the app's configuration page from the nav bar once within the app.
Populate the authorization_conf_url field (badly named!) with a link to your authentication.conf file, along with any auth headers required to get to the url. It must be HTTPS.

Once done, try the command again and let me know how you get on!

0 Karma

sylbaea
Communicator

ah yes, I fully missed the config part, thought it was working out of the box.
Will try and let you know. Thanks.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Meet Splunk Observability Studio: AI-Assisted OpenTelemetry Instrumentation Without ...

Instrumentation is usually the last step or even an afterthought when building out a project. The feature ...

Federated Search for Cisco Security and Analytics Logging (SAL) is now GA on Splunk ...

Federated Search for Cisco  Security Analytics and Logging (SAL) is now generally available as part of the ...

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner   Join us for a demo-driven look at how ...