call not properly authenticated

[NatanS]

Response Code: 401
Response text: <?xml version="1.0" encoding="UTF-8"?>
<response>
<messages>
<msg type="WARN">call not properly authenticated</msg>
</messages>
</response>

I am using Splunk bearer token in my python program using REST API, but suddenly I got this error also I have another precisely program that using Splunk token and it works fine without get the error that I got from the other program.  I already test the token it gets 200 responses. I don't know what happens. 

[PickleRick]

Well. 401 does mean that the authentication was not performed correctly (which means no token provided or wrong token).

So I'd start by checking what requests are being sent to Splunk from your both scripts (the one working properly and the one not working) and comparing the requests (especially the tokens of course).

[NatanS]

../python3.9/site-packages/urllib3/connectionpool.py:1099: InsecureRequestWarning: Unverified HTTPS request is being made to host ''. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
  warnings.warn(
Response Code: 401
Response Text: <?xml version="1.0" encoding="UTF-8"?>
<response>
<messages>
<msg type="WARN">call not properly authenticated</msg>
</messages>
</response>

This is the error from splunk that I got using the token that I made. Its 100% correct token from splunk. Is this because of the ssl ?

[PickleRick]

These are two separate issues.

One is that you're doing a call to https endpoint without verifying server's certificate. That's not a very secure thing to do (especially that you're authenticating yourself against some unverified party) so you're getting a warning from the script.

Another thing is that you're not properly authenticating to the server. That' why you're getting an error response from the server.

[NatanS]

So, what should I do in my program? Do I need to add the ssl certificate? Also how to know properly authenticating to the server? Can I ask for your help about these matters?

Thank you for your attention to this matter, I am waiting for your response

[PickleRick]

As I said - while the connection might be working without properly authenticating the server (verifying server's certificate) the proper way of working with TLS-protected connection is to make sure the server is who it claims it is. So you should make sure your python app can properly verify the server's certificate - the server's cert should be issued by CA that your python code trusts. And that is one thing but it's just a general security-related thing not directly causing the server to return 401.

401 means you're not providing correct authentication data. As I said before - if supposedly the same token works with another host or app comparw the requests made by tue working app and the non-working app and check what is different. We can't know what's wrong as so far the only thing we have is "the server says 401".

[NatanS]

This is the error message from splunk server
ERROR UserManagerPro [727840 TcpChannelThread] - Requesting user info through AQR returned an error Error in Attribute query request, AttributeQueryTransaction err=No error, AttributeQueryTransaction descr=Method Not Allowed, AttributeQueryTransaction statusCode=405 for user: .........

This is from access log (http) 401:
"GET /services/authentication/current-context HTTP/1.1" 401 148 "-" "python-requests/2.31.0" - - - 19ms

And the audit log it said not valid
user=n/a, action=validate_token, info=JsonWebToken validation failed

[marnall]

Perhaps your API request is malformed. Has your python program ever got the desired response, perhaps with another token?

If not, you could post a sanitized version of the segment of your python script that sends the API request, so we can see if there is something wrong.