search

jamf / SplunkBase

Jamf's Published Splunk Base Integration
MIT License
6 stars 4 forks source link

Support for API Roles and Clients #9

Open swolosin opened 3 months ago

swolosin commented 3 months ago

Request: The Splunkbase application "Jamf Pro Add-on for Splunk" currently relies on a standard Jamf account for basic authentication to perform API reads. Is there an alternative method to accomplish this using API Roles and Clients instead of a standard Jamf account?

Why: Jamf has recently updated its authentication protocols, explicitly stating that "Basic authentication in the Classic API is no longer supported and will be deactivated for all instances starting with version 11.5.0 to enhance security." More details can be found here: https://developer.jamf.com/jamf-pro/docs/classic-api-authentication-changes.Furthermore, Jamf is now urging vendors to adopt API Roles and Clients for a more secure and streamlined integration, as detailed in their documentation: https://developer.jamf.com/jamf-pro/docs/client-credentials.

PazDak commented 3 months ago

I tested the latest version of Jamf Pro prior to leaving Jamf in March and it passed it for the Jamf endpoints for the basic auth method and it passed.

I don't have the ability to submit changes any longer or a test instance so you will need to contact Jamf. They have chosen to still list this add-on as supported by the vendor so open a ticket with support@jamf.com

I can't speak to their plans.

That being said... Jump on Mac Admins slack in the #splunk room for more updates.

Sorry if this doesn't help 100%.

swolosin commented 3 months ago

Thank you responding. I've escalated this with our account rep at Jamf.