Splunk Cloud Platform

JAMF Pro Add on for Splunk

skseifert
Engager

we are looking to confirm with the "JAMF Integrations" that this app supports the Jamf Pro API vs Classic API and that it was configured to use the API Roles and Clients with the Access Token, Client ID and Client Secret vs Basic Auth

Labels (2)
0 Karma

marnall
Motivator

It appears that the JAMF classic API uses the paths:

https://server.name.here:8443/JSSResource
https://server.name.here:8443/api

While the JAMF Pro API uses the paths:

https://server.name.here:8443/uapi

There are mentions of the uapi endpoint in the file in the "JAMF Pro Add on for Splunk" app at /JAMF-Pro-addon-for-splunk/bin/uapiModels/devices.py and jamfpro.py in the same directory, so likely the app does use the Pro API as well as the classic API.

However the code for jamfpro.py suggests that it uses basic authentication with username and password to obtain a bearer token, with no mention of Access Token, Client ID, or Client Secret. Thus it is likely the answer to your question about authentications is that the app only supports basic authentication.

 

 

class JamfPro:
    class JamfUAPIAuthToken(object):
    
    ....
    
        def get_token(self):
            url = self.server_url + 'api/v1/auth/token'
            logging.info("JSSAuthToken requesting new token")

            userpass = self._auth[0] + ':' + self._auth[1]
            encoded_u = base64.b64encode(userpass.encode()).decode()
            headers = {"Authorization": "Basic %s" % encoded_u}
            for key in self.extraHeaders:
                headers[key] = self.extraHeaders[key]

            response = self.helper.send_http_request(url="https://" + url,
                                                     method="POST",
                                                     headers=headers,
                                                     use_proxy=self.useProxy)
            if response.status_code != 200:
                raise Exception
            self.unix_timestamp() + 60
            self._set_token(response.json()['token'], self.unix_timestamp() + 60)

 

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...