Authorization Token Not Work

[chenfan]

Hi Splunker,

I tried to enable/disable with API, but I encountered problems with token authentication. I always get the following error. I have also adjusted the API information, but I still can't solve this problem.

curl -v -X POST -k -H "Authorization: Bearer dc73xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" "https://mysplunkserver:8089/servicesNS/nobody/my_app/saved/searches/testalertapi" -d enabled=0

It will be really great if you could share some working examples somewhere in your documentation. 

Thanks in advance!

[livehybrid]

Hi @chenfan 

There are two types of token, one is a JWT token that you can create in the UI via the Tokens page (Bearer). The other is by logging in to the /services/auth/login endpoint and retrieving a session token..

Based on your short token length I suspect you are using a session token (and JWT tokens often start "eyJ") which means the Authorization type should be "Splunk" not "Bearer"

Bearer: Means to use a bearer token header, the standard for Javascript Object Notation (JSON) Web Tokens (JWTs), on which Splunk authentication tokens are based.
Splunk: Means to use the Splunk header for authentication.

Try the following:

curl -v -X POST -k -H "Authorization: Splunk dc73xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" "https://mysplunkserver:8089/servicesNS/nobody/my_app/saved/searches/testalertapi" -d enabled=0

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[chenfan]

Hi @livehybrid

Thankyou for your reply!

I have tried,but it not work.

And this is my token

[livehybrid · Accepted solution]

Hi @chenfan 

That string starting dc736 is *not* your token. This is the token ID.

Its not possible to retrieve the token once created so copy it somewhere safe. If using this type of token then you will need to set use "Bearer" as you were doing before.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[chenfan]

Thank you for your advice, I ignored the token content and cloesd it.

[PrewinThomas]

@chenfan 
Any error messages on splunkd.log? 

You can also refer #https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.3/authenticate-i...

Can you create another token with admin account and test the same.

Also test without token,
curl -k -u admin:yourpassword https://mysplunkserver:8089/servicesNS/nobody/my_app/saved/searches/testalertapi -d enabled=0

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[chenfan]

Yep，I can use useraccount&password to do it.