Getting Data In

How to make REST API call with modular data inputs for Certificate and Key based authentication?

21Sharma
New Member

I am trying to call a 3rd party API which supports Certificate and Key based authentication. I have an on-prem instance of Splunk (Version: 9.0.2) running on a VM. I have verified the API response on the VM via curl command (Command used: curl --cert <"path to .crt file"> --key <"path to .key file"> --header "Authorization: <token>" --request GET <"url">) which gives response for a normal user. However, when running the same curl command using shell in Splunk Add-on Builder's Modular Data Inputs, the command only works with "sudo" otherwise it gives Error 403. When checked with "whoami", it returns the user as root.

Question 1:

Why is the curl command not working without using sudo even when the user is root. Is there any configuration that I need to modify to make it work without using sudo.

Question 2:

How do I make the same API call using Python code in Modular Data Inputs of Splunk Add-on Builder.

Labels (1)
0 Karma

21Sharma
New Member

Thank you for your response @PickleRick. I tried running curl in verbose mode. After successful connection to proxy, I am getting below error but am unable to locate squid.conf file.

X-Squid-Error: ERR_ACCESS_DENIED 0

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Squid is not part of Splunk Enterprise installation. So if you're hitting squid it means either it is working as a reverse-proxy for your target service or you connect to it in order to perform the outbound connection.

Also - if your proxy is doing TLS inspection, cert-based mutual authentication won't work unless you create an exception in your inspection policy.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

1. Run curl with -v to see its operation verbosely. Most probably you're trying to read cryptographic material from a directory you don't have access to.

2. In order to use client certificates you can do it like this:

https://requests.readthedocs.io/en/latest/user/advanced/#client-side-certificates

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...