All Apps and Add-ons

Rapid7 Nexpose Technology Add-On for Splunk: How to resolve "Authentication failed for tenant admin and user nexpose_password" error message?

jtrujillo
Path Finder

I am seeing this error from the system. I have tested this user, and password combination, and it works fine in Rapid7.

WARNING: Athentication failed for tenant admin and user nexpose_password
Info: No JSON object could be decoded

Here are the contents of my conf files. BTW I am using OSX. ... one thing that stands out is that "password = admin" ... which is definitely not the case.

LP-$-OSX:local $ more nexpose_details.conf 
[setupentity]
hostname = https://rapid7-console.usw1.XXX.cloud
import_solution = 1
new_scans_only = 0
password = admin
username = splunk_addon
LP-$-OSX:local $ more passwords.conf 
[credential::nexpose_password:]
password = <some hash>==
0 Karma

splk
Communicator

What I suggest to trace the error down:

  1. recheck if the credentials (user / password) are working and have the correct permissions
  2. reinstall the add-on, make sure no other rapid7 add-on / app is installed (we notice some problems with old installations, despite the fact the app was deactivated)
  3. contact rapid7 splunk support: support@rapid7.com

Kind regards

0 Karma

jtrujillo
Path Finder

Here are some more logs from splunkd.log

02-15-2017 11:26:52.160 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/instances_stats.py" Traceback (most recent call last):
02-15-2017 11:26:52.174 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/instances_stats.py"   File "/Applications/Splunk/etc/apps/openstack_app/bin/api/instances_stats.py", line 54, in <module>
02-15-2017 11:26:52.200 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/instances_stats.py"     main()
02-15-2017 11:26:52.205 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/instances_stats.py"   File "/Applications/Splunk/etc/apps/openstack_app/bin/api/instances_stats.py", line 32, in main
02-15-2017 11:26:52.226 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/instances_stats.py"     auth_token,auth_services = login(user_name,password)
02-15-2017 11:26:52.231 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/instances_stats.py"   File "/Applications/Splunk/etc/apps/openstack_app/bin/api/authentication.py", line 51, in login
02-15-2017 11:26:52.264 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/instances_stats.py"     return auth_token,auth_response_body
02-15-2017 11:26:52.286 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/instances_stats.py" UnboundLocalError: local variable 'auth_response_body' referenced before assignment
02-15-2017 11:26:52.513 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/networks_stats.py" Traceback (most recent call last):
02-15-2017 11:26:52.518 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/networks_stats.py"   File "/Applications/Splunk/etc/apps/openstack_app/bin/api/networks_stats.py", line 41, in <module>
02-15-2017 11:26:52.522 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/networks_stats.py"     main()
02-15-2017 11:26:52.525 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/networks_stats.py"   File "/Applications/Splunk/etc/apps/openstack_app/bin/api/networks_stats.py", line 29, in main
02-15-2017 11:26:52.526 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/networks_stats.py"     auth_token,auth_services = login(user_name,password)
02-15-2017 11:26:52.527 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/networks_stats.py"   File "/Applications/Splunk/etc/apps/openstack_app/bin/api/authentication.py", line 51, in login
02-15-2017 11:26:52.531 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/networks_stats.py"     return auth_token,auth_response_body
02-15-2017 11:26:52.534 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/networks_stats.py" UnboundLocalError: local variable 'auth_response_body' referenced before assignment
02-15-2017 11:26:52.598 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/services_info.py" Traceback (most recent call last):
02-15-2017 11:26:52.600 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/services_info.py"   File "/Applications/Splunk/etc/apps/openstack_app/bin/api/services_info.py", line 43, in <module>
02-15-2017 11:26:52.601 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/services_info.py"     main()
02-15-2017 11:26:52.603 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/services_info.py"   File "/Applications/Splunk/etc/apps/openstack_app/bin/api/services_info.py", line 31, in main
02-15-2017 11:26:52.605 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/services_info.py"     auth_token,auth_services = login(user_name,password)
02-15-2017 11:26:52.606 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/services_info.py"   File "/Applications/Splunk/etc/apps/openstack_app/bin/api/authentication.py", line 51, in login
02-15-2017 11:26:52.607 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/services_info.py"     return auth_token,auth_response_body
02-15-2017 11:26:52.609 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/services_info.py" UnboundLocalError: local variable 'auth_response_body' referenced before assignment
02-15-2017 11:26:52.617 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/volumes_info.py" Traceback (most recent call last):
02-15-2017 11:26:52.628 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/volumes_info.py"   File "/Applications/Splunk/etc/apps/openstack_app/bin/api/volumes_info.py", line 43, in <module>
02-15-2017 11:26:52.629 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/volumes_info.py"     main()
02-15-2017 11:26:52.630 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/volumes_info.py"   File "/Applications/Splunk/etc/apps/openstack_app/bin/api/volumes_info.py", line 31, in main
02-15-2017 11:26:52.632 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/volumes_info.py"     auth_token,auth_services = login(user_name,password)
02-15-2017 11:26:52.634 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/volumes_info.py"   File "/Applications/Splunk/etc/apps/openstack_app/bin/api/authentication.py", line 51, in login
02-15-2017 11:26:52.635 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/volumes_info.py"     return auth_token,auth_response_body
02-15-2017 11:26:52.636 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/volumes_info.py" UnboundLocalError: local variable 'auth_response_body' referenced before assignment
02-15-2017 11:26:52.699 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/routers_stats.py" Traceback (most recent call last):
02-15-2017 11:26:52.701 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/routers_stats.py"   File "/Applications/Splunk/etc/apps/openstack_app/bin/api/routers_stats.py", line 47, in <module>
02-15-2017 11:26:52.702 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/routers_stats.py"     main()
02-15-2017 11:26:52.703 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/routers_stats.py"   File "/Applications/Splunk/etc/apps/openstack_app/bin/api/routers_stats.py", line 31, in main
02-15-2017 11:26:52.704 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/routers_stats.py"     auth_token,auth_services = login(user_name,password)
02-15-2017 11:26:52.706 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/routers_stats.py"   File "/Applications/Splunk/etc/apps/openstack_app/bin/api/authentication.py", line 51, in login
02-15-2017 11:26:52.709 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/routers_stats.py"     return auth_token,auth_response_body
02-15-2017 11:26:52.743 -0700 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/openstack_app/bin/api/routers_stats.py" UnboundLocalError: local variable 'auth_response_body' referenced before assignment
0 Karma

jtrujillo
Path Finder

Couple more log tails

LP-$-OSX:splunk $ tail -10 TA-rapid7_nexpose.log 
2017-02-15 11:27:06,350 INFO    nx_logger:38 - Saving changes made on configuration screen...
2017-02-15 11:27:06,569 INFO    nx_logger:38 - Sucessfully retrieved stored config for Nexpose.
2017-02-15 11:27:06,643 INFO    nx_logger:38 - Password retrieved.
2017-02-15 11:27:07,637 INFO    nx_logger:38 - Executing nexpose_setup.py
2017-02-15 11:27:07,637 INFO    nx_logger:38 - Listing the fields for the set up screen...
2017-02-15 11:27:08,843 INFO    nx_logger:38 - Executing nexpose_setup.py
2017-02-15 11:27:09,676 INFO    nx_logger:38 - Executing nexpose_setup.py
2017-02-15 11:27:09,677 INFO    nx_logger:38 - Listing the fields for the set up screen...
2017-02-15 11:27:10,892 INFO    nx_logger:38 - Executing nexpose_setup.py
2017-02-15 11:27:11,801 INFO    nx_logger:38 - Executing nexpose_setup.py



LP-$-OSX:splunk $ tail -10 rapid7.log 
2017-01-30 10:58:40,811 INFO    nexpose_setup:34 - Executing nexpose_setup.py
2017-01-30 10:58:41,498 INFO    nexpose_setup:34 - Executing nexpose_setup.py
2017-01-30 11:14:15,597 INFO    __init__:168 - Using default logging config file: /Applications/Splunk/etc/log.cfg
2017-01-30 11:14:15,601 INFO    __init__:206 - Setting logger=splunk level=INFO
2017-01-30 11:14:15,602 INFO    __init__:206 - Setting logger=splunk.appserver level=INFO
2017-01-30 11:14:15,603 INFO    __init__:206 - Setting logger=splunk.appserver.controllers level=INFO
2017-01-30 11:14:15,603 INFO    __init__:206 - Setting logger=splunk.appserver.controllers.proxy level=INFO
2017-01-30 11:14:15,605 INFO    __init__:206 - Setting logger=splunk.appserver.lib level=WARN
2017-01-30 11:14:15,605 INFO    __init__:206 - Setting logger=splunk.pdfgen level=INFO
2017-01-30 11:14:15,606 INFO    setup:29 - Executing setup.py
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...