Splunk Search

Installing app in SplunkWeb Manager: error occurred while downloading the app: [HTTP 403] Client is not authorized to perform requested action

jbsplunk
Splunk Employee
Splunk Employee

I have access to Splunk.com without issue.

However when I try to install any app such as SoS and Sideview Utils, from within SplunkWeb > Manager > Apps > Find More Apps Online > select Install Free,
I, and other users, get the following errors:

An error occurred while downloading the app: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/services/apps/remote/entriesbyid/sos

An error occurred while downloading the app: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/services/apps/remote/entriesbyid/sideview_utils
Tags (1)
1 Solution

Ellen
Splunk Employee
Splunk Employee

It was determined the default admin and power roles were modified to disable the following capabilities.

in $SPLUNK_HOME/etc/system/local/authorize.conf

[role_admin]
rest_apps_management = disabled

[role_power]
rest_properties_set = disabled

To install the apps in SplunkWeb's Manager > Apps, change these capabilities from disabled to enabled.

It is recommended the defaults for the admin role especially remain as Splunk provides and instead create a new custom admin role where modifications to the capabilities are made.
Appropriate users can then be assigned this custom role.
This way you are ensured that the admin role remains fully functional by default.

View solution in original post

danmccarthy
Engager

I am experiencing this same issue, and this solution does not solve the problem, as both of those properties are set to "enabled". I am running a trial enterprise license of v 5.0.3 on OSX 10.9.3.

Installing manually as a workaround worked for me, although it'd be a lot simpler if this feature worked as intended. The workaround was just to download the app from splunk.com, then click App->Manage Apps-->Install app from file, and follow the prompts, including a splunk restart.

0 Karma

Ellen
Splunk Employee
Splunk Employee

It was determined the default admin and power roles were modified to disable the following capabilities.

in $SPLUNK_HOME/etc/system/local/authorize.conf

[role_admin]
rest_apps_management = disabled

[role_power]
rest_properties_set = disabled

To install the apps in SplunkWeb's Manager > Apps, change these capabilities from disabled to enabled.

It is recommended the defaults for the admin role especially remain as Splunk provides and instead create a new custom admin role where modifications to the capabilities are made.
Appropriate users can then be assigned this custom role.
This way you are ensured that the admin role remains fully functional by default.

dina_vaghjiani
New Member

Our configuration doesn't have a file of that name in the config. Is it a case of just creating one?

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...