Qualys Technology Add-on (TA) for Splunk (2964) has a known bug that limits the user from updating credentials

Applicability

Description

User can experience issues and difficulties in updating the credentials (username and password) for the Qualys Technology Add-on (TA) for Splunk (2964)

This has been outlined in the following Qualys knowledge articles:

Qualys Splunk App - Issue with changing credentials
Error: Error while posting to url=/servicesNS/nobody/TA-QualysCloudPlatform/storage/passwords/

Investigation

Historically, in versions earlier than 1.8.7 it was necessary to engage Splunk Cloud support to remove the
/opt/splunk/etc/apps/TA-QualysCloudPlatform/local/passwords.conf  file if the password expired or if the username needed to be updated.

Now, if referring to the User Guide and the "Release Notes" section, the requirement to manually remove the passwords.conf file has been addressed under the subject "Reset the username and password from the TA setup page":

"Now, as per the new flow, you do not have to remove the password.conf file while setting the Qualys API credentials from the TA setup page. When you enter the username on the TA setup page, we check if the username already exists in the password.conf file. If the username already exists then we only update the password.

If the username specified on the TA setup page does not exist in the password.conf file, then we fetch the old username from the password.conf file. If the old username is not blank in the file, then we delete the old credentials and add the new username and password specified on the TA setup page. In the case of a new user, we add the new username and password specified on the TA setup page."

Users however, may update their credentials but still fail to see the Qualys data flowing back to their Splunk Cloud and see the following errors in splunkd.log:

Error while posting to url=/servicesNS/nobody/TA-QualysCloudPlatform/storage/passwords/

TA-QualysCloudPlatform (knowledge_base): 2023-02-03 20:26:01 PID=48401 [MainThread] ERROR: Unsuccessful while calling API [403 : Forbidden]. Retrying after 300 seconds: https://qualysapi.qualys.com/api/2.0/fo/knowledge_base/vuln/ with params={'action': 'list', 'details': 'Basic'}. Retry count: 130

Resolution

If the Qualys event data is still not flowing back to Splunk Cloud after updating the credentials, then the splunkd session or daemon may need to be restarted, on the IDM (Inputs Data Manager) for Classic or Search Head (SH) for the Victoria Experience.

Utilize the following searches to check the status:

index=_internal source=/opt/splunk/var/log/splunk/ta_QualysCloudPlatform.log host=idm*splunkcloud.com OR host=sh*splunkcloud.com password

index=_internal source=/opt/splunk/var/log/splunk/ta_QualysCloudPlatform.log host=idm*splunkcloud.com OR host=sh*splunkcloud.com "< new USER-NAME >"

Under the Victoria Experience, users with the sc_admin role can restart splunkd on the SH, either through the UI or via ACS.

Manage a rolling restart in Splunk Cloud Platform
Manage restarts in Splunk Cloud Platform

With Classic Experience, Splunk Cloud support will still need to be engaged to restart splunkd on the IDM.

However, there is a workaround to manage secret storage in an app using the storage/passwords and storage/passwords/name REST API endpoints to avoid engaging support or in case the restart does not fix the problem:

Store a new secret for the user1 user in the secret_storage_test app:

curl -k -u <username>:<password> \
https://<stack-name>.splunkcloud.com:8089/servicesNS/nobody/secret_storage_test/storage/passwords \
-d name=user1 -d password=password1 -d realm=realm1

Update a secret for the user1 user in the secret_storage_test app:

curl -k -u <username>:<password> \
https://<stack-name>.splunkcloud.com:8089/servicesNS/nobody/secret_storage_test/storage/passwords/realm1:user1 \
-d password=password2

Delete a secret for the user1 user from the secret_storage_test app:

curl -k -u <username>:<password> \
--request DELETE https://<stack-name>.splunkcloud.com:8089/servicesNS/nobody/secret_storage_test/storage/passwords/realm1:user1:

Manage secret storage using the Splunk REST API

storage/passwords