Splunk REST API Calls Failing with Authentication Error

Applicability

Description

When attempting to retrieve data from Splunk Cloud using the REST API, or when using the Splunk app within SOAR, authentication failures may occur. The following error messages may be observed:

<?xml version="1.0" encoding="UTF-8"?>
<response>
<messages>
<msg type="WARN">call not properly authenticated</msg>
</messages>
</response>

For the Splunk app on SOAR:

App 'Splunk' started successfully (id: 1762739006022) on asset: 'splunk asset'(id: 13)
Loaded action execution configuration
executing action: test_asset_connectivity
Using token-based authentication
Connecting to es-<stack-name>.splunkcloud.com...
1 action failed
Error from server. Status Code: 401 Data from server: ErrorType: WARN ErrorMessage: call not properly authenticated. Connectivity test failed

Investigation

1. Confirm whether the REST API is enabled in the Splunk Cloud environment.

2. Verify that the relevant IP addresses are included in the IP allow list.

3. Check if the authentication token has expired on the Splunk instance. Renew the token if necessary.

4. Review the logs for any authentication errors, specifically messages indicating an incorrect or expired client secret. For example:

Error: 11-14-2024 10:55:46.973 +0000 ERROR AuthenticationProviderSAML [2985486 webui] - Error message from function=login(): It appears your clientSecret is incorrect. Refer to Microsoft documentation for guidance on retrieving this value: "Create an Azure AD app & service principal in the portal - Microsoft identity platform" / "Option 2: Create a new application secret."

5. Identify if the issue is related to tokens generated by Security Assertion Markup Language (SAML) users. Confirm whether all newly created tokens for SAML users are resulting in the "call not properly authenticated" error.

6. Determine if the issue is limited to SAML users by verifying whether local user accounts, including admin users, are able to authenticate successfully.

Resolution

The issue can be resolved by renewing the Azure App client secret key. Additionally, if the authentication token in Splunk has expired, generate a new token and update the configuration accordingly.

Related Links

Configure authentication extensions to interface with your SAML identity provider

Create and upload a self-signed certificate