IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Outbound email with OAuth

    Posted Wed December 06, 2023 08:40 AM
    Edited by benlinux Wed December 06, 2023 09:52 AM

    Hello Experts,

    I want to integrate IBM SOAR outbound email app with my Microsoft exchange online using OAuth, I referred to the Readme guide regarding this app, but the below aspect seems not to be clear:

    I need assist.

    Thank you



    ------------------------------
    benlinux
    ------------------------------



  • 2.  RE: Outbound email with OAuth

    Posted Thu December 07, 2023 08:49 AM

    Hi Benlinux,

    Could you outline which step you are having difficulty with  and I can see if I can help.

    Meanwhile I will reach out to our development team for support.

    Regards

    John



    ------------------------------
    John Quirke
    ------------------------------

    Original Message


  • 3.  RE: Outbound email with OAuth

    Posted Thu December 07, 2023 09:03 AM

    Hello John,

    I was able to configure Microsoft Azure to collect the required parameters (client id, client secret, token url, auth url), and i used postman to retrieved both access token and refresh token. 

    However, on the outbound email app, it gives the below error when i test configuration:

    fn-outbound-email: 400 Client Error: Bad Request for url: https://login.microsoftonline.com/x.xxxx.x.xxxxxxxxxxxxxxxx/oauth2/v2.0/token   selftest: failure   selftest output:   {'state': 'failure', 'status_code': IntegrationError('400 Client Error: Bad Request for url: https://login.microsoftonline.com/x.x.x..x.x.x.x.x..x.x./oauth2/v2.0/token')}   Elapsed time: 0.925000 seconds

    Sign in to your account

    I am 100% sure that the token url is correct.

    Please assist.



    ------------------------------
    benlinux
    ------------------------------

    Original Message


  • 4.  RE: Outbound email with OAuth

    Posted Fri December 08, 2023 06:58 AM

    Hi Belinux

    I have reached out to the development team and they should be in contact subsequently.

    In the meantime you may be aware of this Oauth2 app on APP Exchange 

    This is a utility to generate an OAuth 2.0 authorization code flow refresh token for an IBM SOAR app.

    https://exchange.xforce.ibmcloud.com/hub/extension/44aaa4fd44c75e22ec979d994ff9948a

    Regards

    John



    ------------------------------
    John Quirke
    ------------------------------

    Original Message


  • 5.  RE: Outbound email with OAuth

    Posted Thu December 14, 2023 12:55 AM

    Hello John,

    Thank you for your swift response.

    I am using a different approach to retrieve the refresh token. I am following this Microsoft documentation  https://learn.microsoft.com/en-us/azure/energy-data-services/how-to-generate-refresh-token#get-a-refresh-token, however when I tried to retrieve the refresh token from a bash terminal suing the authorization code I get the error message ( as shown below) that my authorization code has expired. I know this is related to Microsoft, have you seen this before and how can I obtain a new authorization code? I keep receiving the same authorization code anytime I request for a new one.

    Error message: {"error":"invalid_grant","error_description":"AADSTS70008: The provided authorization code or refresh token has expired due to inactivity. ................................}

    Thank you,



    ------------------------------
    benlinux
    ------------------------------

    Original Message