400: Bad Request for POST Requests to Change Permissions

[ianpittwood]

Issue Description

Using splunklib.client.post to change permissions on eventtypes fails because the client strips out the owner and sharing fields from the body of the request. This results in the body only containing perms.read and perms.write without specified owner or sharing fields. Since these fields are missing, the request returns a 400 Bad Request error code from the Splunk server.

Instance Information

• splunk-sdk version: 1.6.4
• Platform version: macOS 10.13.5
• Framework version: Python 3.6.5
• Splunk version: 7.0.3

Example Code Snippet

# Where self is a wrapper for the Splunklib client
# o = self.service.username
# sharing = 'user'
# perms.read = '*'
# perms.write = '*'
path = '/' + '/'.join([SPLUNK_REST_NAMESPACE, self.service.username, self.app, SPLUNK_REST_EVENT_TYPES, name, SPLUNK_REST_PERMISSION])
body_dict = {
            'owner': owner,
            'sharing': sharing,
            'perms.read': perm_read,
            'perms.write': perm_write,
}
self.service.post(path, **body_dict, output_mode='json')

Correct REST API Request

curl -k -u <user>:<password> <splunk_address>/servicesNS/<user>/<app>/saved/eventtypes/<name>/acl -d owner=<user> -d sharing=user -d perms.read=* -d perms.write=*

Stack Trace

File "/opt/project/splunk_utils/event.py", line 312, in chmod_event_type
return self.service.post(path, **body_dict, output_mode='json')
File "/usr/local/lib/python3.6/site-packages/splunklib/binding.py", line 289, in wrapper
return request_fun(self, *args, **kwargs)
File "/usr/local/lib/python3.6/site-packages/splunklib/binding.py", line 71, in new_f
val = f(*args, **kwargs)
File "/usr/local/lib/python3.6/site-packages/splunklib/binding.py", line 742, in post
response = self.http.post(path, all_headers, **query)
File "/usr/local/lib/python3.6/site-packages/splunklib/binding.py", line 1208, in post
return self.request(url, message)
File "/usr/local/lib/python3.6/site-packages/splunklib/binding.py", line 1228, in request
raise HTTPError(response)
splunklib.binding.HTTPError: HTTP 400 Bad Request -- b'{"messages":[{"type":"ERROR","text":"The following required arguments are missing: owner, sharing."}]}'

[tdhellmann]

@sketchypotato - thanks for the (very detailed!) issue report! We'll take a look.

[lowell80]

I'm running into the same limitation trying to post to the /acl endpoint. @sketchypotato, did you come up with another workaround?

I thought about dropping down to using binding, but still looks like Context would have the same issue, so I'd have to go all the way down to HttpLib, ugh.

Anyone know if #235 works, or when it's scheduled to be merged?

[fantavlik]

I believe this has been addressed in #352 and now released as https://github.com/splunk/splunk-sdk-python/releases/tag/1.6.15 please upgrade via pip install splunk-sdk==1.6.15 and let us know if you continue to see these issues.