Securing Authorization and Authentication of Splunk rest API call

[kannu]

Hello Splunkers,

I’m working on developing an app that requires making REST API calls to Splunk in order to gather information about saved searches, knowledge objects, and more.

Could you please advise on the most secure method for authorization and authentication? Does the REST API support MFA, or are there other mechanisms available, with or without SAML?

Is token generation the only secure way to make these API calls, or are there alternative methods?

Thanks 

Manish Kumar

[sainag_splunk · Accepted solution]

1. Token Authentication: This is definitely your best bet for security. You can create these through Splunk Web or via the API itself.  https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTtoken
2. HTTPS: Always, always use HTTPS for your API calls. It's a must for encryption.
3. RBAC Make sure your API user or token only has the permissions it absolutely needs. Less is more when it comes to security! Create splunk roles and map accordingly.
4. MFA: While Splunk supports MFA for user logins, it's not directly used for API calls. Instead, you'd set up MFA for the user generating the API tokens. https://docs.splunk.com/Documentation/SIM/current/User/SetupMFA
   
   
5. SAML: If you're using SAML, you'll still use tokens for API access. SAML is more for the web interface.

Tokens are usually the way to go for most scenarios.

https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/SetupuserauthenticationwithSplunk
https://docs.splunk.com/Documentation/Splunk/9.3.1/Security/UseAuthTokens

Hope this helps!

[PickleRick]

From the security standpoint token authentication doesn't differ from user/password authentication. It's still authentication with a static secret.

You can't use SAML for REST API authentication.

You might want to think about integrating an external credentials provider like Conjur and rotating the tokens often