Developing for Splunk Platform

Need help on the splunk.entity.getEntities

mbachhav
Path Finder
We have TA for Splunk and are using Splunk's internal library(splunk.entity) to fetch the credentials from passwords.conf file using the below code. 
 
On some Splunk enterprise instances below code is working properly and returning username and clear password. But on some Splunk enterprise instances and Splunk cloud, it has been observed that the value of ['eai:acl']['app'] is Null due to which exception has been raised by the code.
 
We would like to know why some Splunk instances return the Null value for ['eai:acl']['app'].
 
Code - 

import splunk.entity as entity

myapp = 'APP-NAME'
realm = 'APP-NAME-Api'
 
try:
    entities = entity.getEntities(['admin', 'passwords'], namespace=myapp, owner='nobody', sessionKey=session_key)    
except Exception as e:
    raise Exception("Could not get %s credentials from Splunk. Error: %s" % (myapp, str(e)))
 
for i, c in list(entities.items()):
    if c['eai:acl']['app'] == myapp and c['realm'] == realm:
        return c['username'], c['clear_password']
 

raise Exception("No credentials found.")

We also tried with the below CURL command but the field ['eai:acl']['app'] is missing in the response.

curl -k -u <splunk_username>:<splunk_password> https://<host>:8089/services/storage/passwords

 

 

Labels (2)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@mbachhav 

Does the user have appropriate capabilities to access password?

users require the list_storage_passwords capability to read plain text secrets and the admin_all_objects capability to create, update, and delete secrets.

 

Thanks
KV
▄︻̷̿┻̿═━一   😉

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma

mbachhav
Path Finder

@kamlesh_vaghela ,

Yes, a user has capabilities to access passwords and access to  list_storage_passwords  and admin_all_objects capabilities.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...