SOAR - Splunk ES and SOAR Pairing Fails After Nightly Token Refresh

Applicability

Description

Splunk Enterprise Security can pair successfully with Splunk SOAR, but the pairing fails after an overnight token refresh cycle. Splunk SOAR displays the error:

SOAR returned an error: No Splunk credentials were available in SOAR.

Re-pairing temporarily restores connectivity. The condition is associated with the es_soar_integration role not being included in the grantableRoles configuration for splunk-system-role, which can prevent the splunk-system-user token refresh from completing.

Investigation

Search logs for token-refresh permission warnings:

index=_internal "JsonWebTokenHandler" "is not grantable by user"  

Confirm whether the warning identifies es_soar_integration as not grantable, a line likes this: Expect a line like: Role=es_soar_integration is not grantable by user splunk-system-user 

Review the current grantableRoles list for splunk-system-role using the Splunk management endpoint.

Check mc_create_ingest_soar_tokens.log for a successful checkpoint message after the scheduled token refresh.

Verify the ES–SOAR pairing status and role mappings on the Splunk Enterprise Security pairing page.

Resolution

Retrieve the existing grantableRoles configuration for splunk-system-role.

curl -ku "$ES_ADMIN_USER" "https://${ES_URL}:8089/services/authorization/roles/splunk-system-role?output_mode=json"

Append es_soar_integration to the existing grantableRoles list. Do not overwrite existing role values.

curl -ku "$ES_ADMIN_USER" -X POST "https://${ES_URL}:8089/services/authorization/roles/splunk-system-role" \
--data-urlencode "grantableRoles=<existing_values>,es_soar_integration"

Re-read the role configuration and confirm that es_soar_integration is present.

curl -ku "$ES_ADMIN_USER" "https://${ES_URL}:8089/services/authorization/roles/splunk-system-role?output_mode=json" | grep -i grantable

Run the SOAR integration health check and confirm that is_soar_paired, soar_connectivity, token_modinput_enabled, and jwk_healthy report healthy values.

curl -ku "$ES_ADMIN_USER" "https://${ES_URL}:8089/servicesNS/nobody/missioncontrol/v1/soar/health?output_mode=json"

Confirm that subsequent token-refresh activity no longer produces the JsonWebTokenHandler “is not grantable” warning and that mc_create_ingest_soar_tokens.log records a successful checkpoint.