Getting Data In

Can you query the REST API with a non-local account?

a212830
Champion

Hi,

I have a customer who is trying to query the Splunk REST API using an established AD service account, which has the same privileges as individual accounts. When he tries to query Splunk, however, he gets "Unauthorized". Is it possible to query the REST API with non-local accounts?

0 Karma

sloshburch
Splunk Employee
Splunk Employee

Yea its possible. In fact, all the web activity basically runs REST calls under the hood. It's likely the user is trying to use their unix credentials instead of their splunk credentials. Or maybe the system they are calling to doesn't have the ldap configured? Make sure the ldap strategy lives on everything (except the forwarders if you want) so the same credentials are valid when the search is delegated from search head to indexers.

0 Karma

a212830
Champion

The indexers need the ldap setup? Why? Doesn't the request go through the SH? And if that's the case, wouldn't the same requirement be there for all my users?

0 Karma

sloshburch
Splunk Employee
Splunk Employee

I always set up my ldap config in an app that I distribute to EVERYTHING because I don't want anyone logging on with local credentials and making a mess of things. I want only credible audit-able accounts logging into the system.
I vaguely recall experiences before I did this where users defined locally only on the SH were failing because the indexer knew nothing of that user. My memory sucks so I may have conflated experiences 😞

0 Karma

a212830
Champion

I don't want the ldap config on all my idx. Could end up with people logging in and just getting confused - I only want the admin accounts and support people on those servers.

0 Karma

sloshburch
Splunk Employee
Splunk Employee

Oh, if you don't already have it, make sure splunkweb is OFF on the indexers. If you need to make config changes, those should go through the master node. Not only will that open up some resources back to indexer activities (because splunkweb is off) but it blocks users from accidentally navigating to the web UI and getting mixed up.

Either way, you shouldn't have issues with the non local account thang. If that is persisting, we might collaborate offline to see what's up.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...