Issues while using admin/password endpoint

[Kirangiri123]

Hi,

I'm trying to use admin/password endpoint to store credentials securely (using sample http://blogs.splunk.com/2011/03/15/storing-encrypted-credentials/). but splunkd is throwing an exception as shown below.

” Exception: Could not get TA-Sample credentials from splunk. Error: [HTTP 500] Splunkd internal error; [{'type': 'ERROR', 'text': "In handler 'passwords': Cannot base64 decode encrypted password", 'code': None}]

Any inputs on this will be really helpful.

Below is the python code and app.conf
App.conf

[ui]
is_visible = 0
label = TA-accuvant

[launcher]

[package]
check_for_updates = 1

[install]
is_configured = 1

[credential::user2:]
password = $1$XJHN09pBlRtp

Handler Python function

def getCredentials(session):

myapp = ‘TA-Accuvant’
try:

entities = entity.getEntities(['admin', 'passwords'], namespace=myapp,
owner=’nobody’, sessionKey=session)
except Exception, e:
raise Exception(“Could not get %s credentials from splunk. Error: %s”
% (myapp, str(e)))

for i, c in entities.items():
return c['username'], c['password']

raise Exception(“No credentials have been found”)

[Ledion_Bitincka]

Kiran, I'd suggest you ask another question so one of our internal python experts would be able to point you to the right direction. I can make one recommendation that has worked for me in the past, in MySQL Connector app, try to find a pure python driver for MSSQL if at all possible - then you'd be able to use it just by placing it in your app's bin dir (see MySQLConnector for an example of how/where to place the driver).

[Ledion_Bitincka]

What version of Splunk are you using, so I can try to repro this?

[Kirangiri123]

/usr/bin/python: /opt/splunk/lib/libz.so.1: no version information available (required by /usr/bin/python) /usr/bin/python: /opt/splunk/lib/libcrypto.so.0.9.8: no version information available (required by /usr/bin/python) /usr/bin/python: /opt/splunk/lib/libssl.so.0.9.8: no version information available (required by /usr/bin/python) /opt/splunk/lib/python2.7/site-packages Traceback (most recent call last):, line 7, in import lxml.etree as et ImportError: /opt/splunk/lib/python2.7/site-packages/lxml/etree.so: undefined symbol: PyUnicodeUCS2_AsEncodedString

[Kirangiri123]

Ledion,

I made some changes and restarted splunk. It started working magically. Still not sure what fixed my code.

Now. I am trying to load splunk libraries using system python( I have some custom python packages like pymssql ).

I researched in splunkbase and the best approach suggested by one the developers was Can I add python modules to the Splunk environment? on Splunk Answers

But, this approach is again throwing exception as below. Have you come across this issue?

[Ledion_Bitincka]

hmm still can't repro. Does the same thing happen for other password values too?

[Kirangiri123]

password is 123.

[Ledion_Bitincka]

Hmm, I'm not able to reproduce the problem in that build. Does this happen for all passwords or just this one? Do you mind sharing the clear password string - I hope it's not real 🙂

[Kirangiri123]

Splunk 5.0.1 build 143156.

[Ledion_Bitincka]

Kiran, how was the entry in apps.conf [credential::user2:] created? Basically, Splunk is having troubles base64 decoding the encrypted password "XJHN09pBlRtp"

[Kirangiri123]

I'm using entity=_new in setup.xml which stores password in app.conf

Here is the sample.xml snippet

Username
text


Password
password