Security

Why am I receiving a 401 "Unauthorized" error for all queries via Java API?

tdhealy
Explorer

Using Java 8 with Splunk 6.5.3, attempting to connect with Java API to get a service object. Using the same username and password I can connect with a browser and run queries normally. I suspect an SSL / https handler issue since the return from service has a token but the value for httpHandler is null. I do not know how to approach it.

I currently have:

loginArgs.setSSLSecurityProtocol(SSLSecurityProtocol.TLSv1_2);

Any suggestions very much appreciated.
Thanks

Tags (5)

randyabeyta
Engager

This seems to be a known issue with Java 8:

http://dev.splunk.com/view/java-sdk/SP-CAAAEUV

It may be that you need to tie in the security protocol with the service, and not your login args. In the above documentation, it links to this test class:

https://github.com/splunk/splunk-sdk-java/blob/develop/examples/com/splunk/examples/ssl_protocols/Pr...

0 Karma

tdhealy
Explorer

Thanks for your help Randy. I had found that Program.java yesterday after Googling my ass off, but it had failed too. So I revisited it and found that the SDK Command parser was corrupting my password string by dropping one character. So I used ServiceArgs to tray an alternative and all the connections now worked! The connection part is shown below.

public SplunkNAT(Properties pr) {

    props = pr;
    errLog = Utils.initLogging(props);

    ServiceArgs loginArgs = new ServiceArgs();
    loginArgs.setUsername(user);
    loginArgs.setPassword(auth);
    loginArgs.setHost(host);
    loginArgs.setPort(port);
    loginArgs.setScheme("https");
    loginArgs.setSSLSecurityProtocol(SSLSecurityProtocol.TLSv1_2);

    System.out.println("Now trying to connect to Splunk using TLSv1.2");
    try {
        Service.setSslSecurityProtocol(SSLSecurityProtocol.TLSv1_2);
        service = Service.connect(loginArgs);
        service.login();
        System.out.println("\t Success!");

    } catch (RuntimeException re) {
        errLog.severe("Unable to make Splunk Service: " + re.getMessage()
                + ExceptionUtils.getStackTrace(re));
    }
    System.out.println("Installed apps: " + service.getApplications().keySet());
}

-Terry

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...