IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  QRADAR SAML bypass URL?

    Posted 03/07/21 07:29 AM
    Dear all,

    We are planning to integrate QRADAR with Okta, it will be using the SSO method. Once SSO is implemented all logins will be through redirected through SSO, is there a way to bypass them? I know many applications do provide a bypass URL. Does anyone have info on this?

    T&R
    Arjun Kumar

    ------------------------------
    Arjun Kumar Network & Security Engineer
    ------------------------------


  • 2.  RE: QRADAR SAML bypass URL?

    Posted 03/08/21 12:35 PM
    Arjun,
    Okta is supporting LDAP, so there should be no problem integrating it with QRadar interactive users for SSO. When you talk about bypass URL you probably think about the RESTFUL API provided.
    For accessing QRadar from external you need to define an authorized service inside QRadar and talk to QRadar from you program passing token and URL for the functions you are looking for. Easiest way is implementation via curl script. Pls check the integrated Interactive API for more details.
    BR
    Karl

    ------------------------------
    [Karl] [Jaeger] [Business Partner]
    [QRadar Specialist]
    [pro4bizz]
    [Karlsruhe] [Germany]
    [4972190981722]
    ------------------------------



  • 3.  RE: QRADAR SAML bypass URL?

    Posted 03/09/21 01:37 AM
    Dear Karl
    Thank you for your response. We have tested the SSO functionality and it works flawlessly, I just wanted to know if I don't want to use SSO is there a bypass URL to access the QRadar UI and login with local admin credentials. 

    T&R

    ------------------------------
    Arjun Kumar Network & Security Engineer
    ------------------------------

    Original Message


  • 4.  RE: QRADAR SAML bypass URL?

    Posted 03/09/21 07:00 AM
    Edited by Paul Leonard 03/09/21 07:04 AM
    There isn't a 'bypass UR'L for SAML user authentication.

    As you observed, SAML is not like the other methods that use 'fallback' to the Local password.

    See the docs for Troubleshooting SAML authentication, subtopic ' Restore system login for investigation' for how to fallback.
    You edit the running login.conf by hand to restore System auth in the event of trouble. .
    ------------------------------
    Paul Leonard
    ------------------------------

    Original Message


  • 5.  RE: QRADAR SAML bypass URL?

    Posted 03/09/21 08:28 AM
    Hey I think they meant that in the case of an SSO or network outage being able to still authenticate to GUI but not using sso. We are in the same boat and current solution is to SSH on and disable the SSO config in the event that occurs.

    - Ian



    Original Message


  • 6.  RE: QRADAR SAML bypass URL?

    Posted 03/10/21 01:09 AM
    Yes, as Ian mentioned this is our main concern. There has to be a bypass URL for admin access incase the IDP provider is down.

    ------------------------------
    Arjun Kumar Network & Security Engineer
    ------------------------------

    Original Message


Related Content