All Apps and Add-ons

How does Splunk DB Connect identity.dat file gets generated?

mchristopherson
Explorer

We are working on automating the installation and configuration of Splunk DB Connect.  For the purposes of this question we are using DB Connect version 3.6.0

My question is how does the identity.dat file get generated.  We know it gets generated on a fresh DB Connect install the first time an identity is created manually.  Our issue is the DB Connect API endpoint for creating identities returns a 200 OK when creating an identity for the first time - but it does not get created and no identity.dat file is generated.

If after a fresh install of DB Connect we manually though the UI add an identity - the identity.dat file is successfully generated.  We are then able to hit the endpoint to create identities and it creates them correctly.

The endpoint that we are hitting is:

 

/servicesNS/nobody/splunk_app_db_connect/db_connect/dbxproxy/identities

 

The payload that we are uploading to the endpoint is formatted as such:

 

    def output(self):
        data = {}
        data["name"] = self.db_identity_name
        data["username"] = self.db_username
        data["password"] = self.db_password
        data["disabled"] = self.disabled
        data["domain_name"] = self.domain_name
        data["use_win_auth"] = self.use_win_auth
        return data

 

Labels (2)
1 Solution

mchristopherson
Explorer

This file gets auto generated.  It helps if your filesystem level permissions are set correctly so the user and group running splunk own the splunk_app_db_connect directory and sub-directories.  We had an issue with our ansible where these were being set to root:root instead of splunk:splunk.

Once we resolved that issue the indentity.dat file auto generates when splunk starts up.  The 200 OK's were still concerning to get when hitting the API even though no identity was actually created.

View solution in original post

0 Karma

mchristopherson
Explorer

This file gets auto generated.  It helps if your filesystem level permissions are set correctly so the user and group running splunk own the splunk_app_db_connect directory and sub-directories.  We had an issue with our ansible where these were being set to root:root instead of splunk:splunk.

Once we resolved that issue the indentity.dat file auto generates when splunk starts up.  The 200 OK's were still concerning to get when hitting the API even though no identity was actually created.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...