Need help on the splunk.entity.getEntities

[mbachhav]

We have TA for Splunk and are using Splunk's internal library(splunk.entity) to fetch the credentials from passwords.conf file using the below code. 

On some Splunk enterprise instances below code is working properly and returning username and clear password. But on some Splunk enterprise instances and Splunk cloud, it has been observed that the value of ['eai:acl']['app'] is Null due to which exception has been raised by the code.

We would like to know why some Splunk instances return the Null value for ['eai:acl']['app'].

Code - 

import splunk.entity as entity

myapp = 'APP-NAME'

realm = 'APP-NAME-Api'

try:

    entities = entity.getEntities(['admin', 'passwords'], namespace=myapp, owner='nobody', sessionKey=session_key)    

except Exception as e:

    raise Exception("Could not get %s credentials from Splunk. Error: %s" % (myapp, str(e)))

for i, c in list(entities.items()):

    if c['eai:acl']['app'] == myapp and c['realm'] == realm:

        return c['username'], c['clear_password']

raise Exception("No credentials found.")

We also tried with the below CURL command but the field ['eai:acl']['app'] is missing in the response.

curl -k -u <splunk_username>:<splunk_password> https://<host>:8089/services/storage/passwords

[kamlesh_vaghela]

@mbachhav 

Does the user have appropriate capabilities to access password?

users require the list_storage_passwords capability to read plain text secrets and the admin_all_objects capability to create, update, and delete secrets.

Thanks
KV
▄︻̷̿┻̿═━一   😉

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

[mbachhav]

@kamlesh_vaghela ,

Yes, a user has capabilities to access passwords and access to  list_storage_passwords  and admin_all_objects capabilities.