Getting Data In

How can I fix MS Cloud Services TA Auth error?

pbarbuto
Path Finder

We migrated the MSCS TA to a new HF and are receiving authentication errors even though we're using the same client id, secret, and tenant id. I'm thinking its likely something network related and the auth error is misleading. I'm trying to find out exactly what URL(s) I need to whitelist - I cant find anything in the docs.

Here is the error: "REST Error [400]: Bad Request -- Account authentication failed. Please check your credentials and try again".

Like I said, I am using the same credentials, just a different host.

Thanks.

0 Karma

merrelr
Path Finder

I had the same issue setting up an Azure App Account. Turns out it was due to having

mgmtHostPort = 0.0.0.0:8089

vs the default of

mgmtHostPort = 127.0.0.1:8089

in web.conf/[settings].

0 Karma

jconger
Splunk Employee
Splunk Employee

How did you migrate? If it was a file copy rather than a new installation, your client secret may not decrypt correctly if your splunk.secret file is not the same.

0 Karma

pbarbuto
Path Finder

Its not a file copy. Its a new install of the TA on a different host. I didnt copy any of the files, just recreating the configs and inputs on the new host using the same credentials and authentication details.

0 Karma

mnajeeb93
Engager

Where you able to resolve this problem? I am facing the same issue. 

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...