Local Authentication to the ACS API

[billathena]

I'm having trouble working out how to authenticate to the Splunk Cloud ACS API using a local account. The doco suggests you can do this:

https://docs.splunk.com/Documentation/SplunkCloud/8.2.2106/Admin/ConfigureIPAllowList

I can hit the API successfully with a SAML token, but I need to be able to use a local account to authenticate right now.

Can anyone shed some light on how you're meant to auth with a local account?

I've tried using the session token provided by the auth/login endpoint, and also Basic auth (user/pass), but neither work.

[DaveBunn]

@billathena did you ever resolve this issue, I'm in the same position.

[billathena]

I did not unfortunately @DaveBunn , I ended up having to use a SAML token. In retrospect, this is probably more secure than basic auth anyway.

At the time of posting, my concern was with having a token that needed to be referenced in a bunch of places, so could be discovered and misused. We ended up implementing automated rotation of tokens to allay those concerns, which got us comfortable enough to move forward. This means the token is kept secret from our devs, is better protected, and we don't need to worry about refreshing it manually when it expires.

If of interest, see the code at:

https://github.com/Athena-Home-Loans/keydra/blob/fb862a4d9310e864c13e132c4c7d06ea24931914/src/keydra...