Splunk Dev

How to save sensitive data (JWT token) in add-on which splunk cloud would allow

cool_cat
Observer

Hi all, 

I am just learning Splunk because the need for applying our addon to be cloud vetted ( therefore I really don't know much splunk development yet, but need to get this done soon) . It is an addon to connect to our server and pulling in logs. Each pull would have to auth first, therefore we save token locally so only need auth once for certain interval ( lifetime of the token). But that won't do for cloud based addon. (Vetting report says " Storing authentication token in checkpoint which is not allowed in Splunk cloud. Please don't store such sensitive information")

Any other way I can save token for addon functionality purpose? . I heard mentioning of storage/passwords endpoint, is that only for user credential or it can be used for saving application token as well?

 

Thanks in advance! I searched whole day, still not clear the direction. 

Labels (1)
0 Karma

cool_cat
Observer

It is not static. It needs to be used for each poll. It will need to be updated when it expires. About every 15mins. Is there anyway the endpoint you mentioned can be written?

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Yes you can update the token on storage/passwords endpoint but you need to code that in your script.

0 Karma

cool_cat
Observer

That is good to know! Is there any chance you can point me some sample code on how to achieve that? I am really just start to learn splunk development. 

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Have a look at code in https://github.com/splunk/TA-VaultSync/tree/master/bin , you'll get idea.

0 Karma

cool_cat
Observer

Thank you so much!

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

You're welcome!

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

If token is static then you can use storage/passwords endpoint to store token and in your script read token from same endpoint.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...