IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  LDAP configuration setting in appconfig

    Posted 10/25/21 09:00 AM
    Good Day,

    I am using the following function for query to LDAP:
    IBM Security App Exchange - LDAP and Active Directory Functions for SOARhttps://exchange.xforce.ibmcloud.com/hub/extension/72b8204066d3b290b68bae2eeb1942cd

    I am getting the following errors while trying to query the LDAP

    2021-10-25 18:22:12,486 ERROR [actions_component] <task[functionworker] (<function function.__call__.<locals>.decorated.<locals>._call_the_task at 0x7f7da453bc80>, <ldap_utilities_search[functions.ldap_utilities_search] (id=47, workflow=example_ldap_utilities_search, user=adil.islam@askaribank.com.pk) 2021-10-25 13:22:12.052000> ldap_search_filter={'format': 'text', 'content': '(&(objectClass=person)(mail=*%ldap_param%))'}, ldap_search_attributes='uid,cn,sn,mail,telephoneNumber', ldap_search_base='dc=example,dc=com', ldap_search_param='abdullah.khan')> (<class 'resilient_circuits.action_message.FunctionException_'>):
    Traceback (most recent call last):
    File "/usr/local/lib/python3.6/site-packages/fn_ldap_utilities/components/ldap_utilities_search.py", line 84, in _ldap_utilities_search_function
    helper = LDAPUtilitiesHelper(self.options)
    File "/usr/local/lib/python3.6/site-packages/fn_ldap_utilities/util/helper.py", line 90, in __init__
    raise ValueError("'ldap_user_dn' and 'ldap_password' must be defined in the app.config file if using SIMPLE authentication to your LDAP Server")
    ValueError: 'ldap_user_dn' and 'ldap_password' must be defined in the app.config file if using SIMPLE authentication to your LDAP Server

    Following is my configuration in appconfig:

    I would a great help is someone share the working configuration or help me with the error.


    ------------------------------
    Asad Aftab
    ------------------------------


  • 2.  RE: LDAP configuration setting in appconfig

    Posted 11/04/21 05:19 AM
    Hi, not an expert on LDAP, and I do not have an AD under my hand.
    You should open a support ticket to solve this, if you haven't solved it yourself since

    ------------------------------
    BENOIT ROSTAGNI
    ------------------------------



  • 3.  RE: LDAP configuration setting in appconfig

    Posted 11/04/21 04:27 PM
    Greetings!

    Make sure that you are reading the app.config correctly, it seems it cannot find those values. Sometimes, Resilient resorts to a default app.config if it does not find the supplied one.

    Try and print the values inside of self.options (with print self.options) and check if the values are actually there.

    Hope it helps!



    ------------------------------
    Pol Estecha
    ------------------------------



  • 4.  RE: LDAP configuration setting in appconfig

    Posted 11/05/21 09:39 AM
    Edited by Elizabeth Hecht 11/05/21 09:39 AM
    Hi Asad,
    One thing I can see in the error message above is
    ldap_search_base='dc=example,dc=com', ldap_search_param='abdullah.khan')> (<class 'resilient_circuits.action_message.FunctionException_
    Make sure you make changes to the inputs in function within your workflow to contain the correct values for your environment. It looks like this one might be the problem:

    ldap_search_base

    String

    Yes

    "dc=example,dc=com"



    ------------------------------
    Elizabeth Hecht
    ------------------------------