IBM Security QRadar

Hi Community,

before the Forum Migration there was a topic regarding the Token problem using QDI 2.2.5. I can't find this topic here. Therefore I ask the same question:

When I try to configure the SEC Token, I get the following error.

"WARNING: REST API accessf ails with the provided token. Please verify if the token has Admin access and is deployed"

already tried different tokens and deployed a couple of times. Tokens also work with other applications and REST API.

Is a case the only solution?

I have Qradar 7.3.3 FP1

Thank you

regards,

Bruno

------------------------------
Bruno Oliveira
------------------------------

Hi Bruno,

I recently got the same issue. The problem we had, was that our custom ssl certificate was not in the trust store.
So you should copy the correct certificate to /etc/pki/ca-trust/source/anchors/ on the system where the apps are running and then execute update-ca-trust. Newer versions of apps no longer ignore certificate issues.

I hope this solution also works for you.


Regards,

Paul
Original Message:
Sent: Tue April 07, 2020 09:22 AM
From: Bruno Oliveira
Subject: QDI 2.2.5 and Token

Hi Community,

before the Forum Migration there was a topic regarding the Token problem using QDI 2.2.5. I can't find this topic here. Therefore I ask the same question:

When I try to configure the SEC Token, I get the following error.

"WARNING: REST API accessf ails with the provided token. Please verify if the token has Admin access and is deployed"

already tried different tokens and deployed a couple of times. Tokens also work with other applications and REST API.

Is a case the only solution?

I have Qradar 7.3.3 FP1

Thank you

regards,

Bruno

------------------------------
Bruno Oliveira
------------------------------

Thank you for your message. The problem was that in the custom certificate there was the hostname but not the FQDN in the alt_extensions .

------------------------------
Bruno Oliveira
------------------------------

Original Message:
Sent: Thu April 09, 2020 12:00 PM
From: Paul Teichmann
Subject: QDI 2.2.5 and Token

Hi Bruno,

I recently got the same issue. The problem we had, was that our custom ssl certificate was not in the trust store.
So you should copy the correct certificate to /etc/pki/ca-trust/source/anchors/ on the system where the apps are running and then execute update-ca-trust. Newer versions of apps no longer ignore certificate issues.

I hope this solution also works for you.


Regards,

Paul
Original Message:
Sent: Tue April 07, 2020 09:22 AM
From: Bruno Oliveira
Subject: QDI 2.2.5 and Token

Hi Community,

before the Forum Migration there was a topic regarding the Token problem using QDI 2.2.5. I can't find this topic here. Therefore I ask the same question:

When I try to configure the SEC Token, I get the following error.

"WARNING: REST API accessf ails with the provided token. Please verify if the token has Admin access and is deployed"

already tried different tokens and deployed a couple of times. Tokens also work with other applications and REST API.

Is a case the only solution?

I have Qradar 7.3.3 FP1

Thank you

regards,

Bruno

------------------------------
Bruno Oliveira
------------------------------

Hi,

I had the same issue when i tried to install QDI 2.2.5.
QRadar SIEM is 7.4.0 FixPack4.
I did the steps and recommendations that you both provide but no success.
So i uninstall QDI 2.2.5 and install QDI 2.2.4. Configuration of the SEC Token passed smoothly.
After that i upgrade to QDI 2.2.5 and the extension is working ok.
So this is the workaround that helped me.

BR,

------------------------------
Aleksandar Stojanovski
------------------------------

Original Message:
Sent: Wed April 22, 2020 04:07 PM
From: Bruno Oliveira
Subject: QDI 2.2.5 and Token

Thank you for your message. The problem was that in the custom certificate there was the hostname but not the FQDN in the alt_extensions .

------------------------------
Bruno Oliveira

Original Message:
Sent: Thu April 09, 2020 12:00 PM
From: Paul Teichmann
Subject: QDI 2.2.5 and Token

Hi Bruno,

I recently got the same issue. The problem we had, was that our custom ssl certificate was not in the trust store.
So you should copy the correct certificate to /etc/pki/ca-trust/source/anchors/ on the system where the apps are running and then execute update-ca-trust. Newer versions of apps no longer ignore certificate issues.

I hope this solution also works for you.


Regards,

Paul
Original Message:
Sent: Tue April 07, 2020 09:22 AM
From: Bruno Oliveira
Subject: QDI 2.2.5 and Token

Hi Community,

before the Forum Migration there was a topic regarding the Token problem using QDI 2.2.5. I can't find this topic here. Therefore I ask the same question:

When I try to configure the SEC Token, I get the following error.

"WARNING: REST API accessf ails with the provided token. Please verify if the token has Admin access and is deployed"

already tried different tokens and deployed a couple of times. Tokens also work with other applications and REST API.

Is a case the only solution?

I have Qradar 7.3.3 FP1

Thank you

regards,

Bruno

------------------------------
Bruno Oliveira
------------------------------

Por casualidad tienes algún link para la versión QDI 2.2.4?.

El link de X-Force Exchange es solo QDI 2.2.5

------------------------------
Israel Guevara
------------------------------

Original Message:
Sent: Fri July 10, 2020 07:39 AM
From: Aleksandar Stojanovski
Subject: QDI 2.2.5 and Token

Hi,

I had the same issue when i tried to install QDI 2.2.5.
QRadar SIEM is 7.4.0 FixPack4.
I did the steps and recommendations that you both provide but no success.
So i uninstall QDI 2.2.5 and install QDI 2.2.4. Configuration of the SEC Token passed smoothly.
After that i upgrade to QDI 2.2.5 and the extension is working ok.
So this is the workaround that helped me.

BR,

------------------------------
Aleksandar Stojanovski

Original Message:
Sent: Wed April 22, 2020 04:07 PM
From: Bruno Oliveira
Subject: QDI 2.2.5 and Token

Thank you for your message. The problem was that in the custom certificate there was the hostname but not the FQDN in the alt_extensions .

------------------------------
Bruno Oliveira

Original Message:
Sent: Thu April 09, 2020 12:00 PM
From: Paul Teichmann
Subject: QDI 2.2.5 and Token

Hi Bruno,

I recently got the same issue. The problem we had, was that our custom ssl certificate was not in the trust store.
So you should copy the correct certificate to /etc/pki/ca-trust/source/anchors/ on the system where the apps are running and then execute update-ca-trust. Newer versions of apps no longer ignore certificate issues.

I hope this solution also works for you.


Regards,

Paul
Original Message:
Sent: Tue April 07, 2020 09:22 AM
From: Bruno Oliveira
Subject: QDI 2.2.5 and Token

Hi Community,

before the Forum Migration there was a topic regarding the Token problem using QDI 2.2.5. I can't find this topic here. Therefore I ask the same question:

When I try to configure the SEC Token, I get the following error.

"WARNING: REST API accessf ails with the provided token. Please verify if the token has Admin access and is deployed"

already tried different tokens and deployed a couple of times. Tokens also work with other applications and REST API.

Is a case the only solution?

I have Qradar 7.3.3 FP1

Thank you

regards,

Bruno

------------------------------
Bruno Oliveira
------------------------------

Hi,
I solved the same problem for myself by adding to /store/docker/volumes/qapp-****/consolecert.pem
text from the certificate chain
----- BEGIN CERTIFICATE -----
----- END CERTIFICATE -----

------------------------------
Denis Filatov
------------------------------

Original Message:
Sent: Wed July 29, 2020 04:20 PM
From: Israel Guevara
Subject: QDI 2.2.5 and Token

Por casualidad tienes algún link para la versión QDI 2.2.4?.

El link de X-Force Exchange es solo QDI 2.2.5

------------------------------
Israel Guevara

Original Message:
Sent: Fri July 10, 2020 07:39 AM
From: Aleksandar Stojanovski
Subject: QDI 2.2.5 and Token

Hi,

I had the same issue when i tried to install QDI 2.2.5.
QRadar SIEM is 7.4.0 FixPack4.
I did the steps and recommendations that you both provide but no success.
So i uninstall QDI 2.2.5 and install QDI 2.2.4. Configuration of the SEC Token passed smoothly.
After that i upgrade to QDI 2.2.5 and the extension is working ok.
So this is the workaround that helped me.

BR,

------------------------------
Aleksandar Stojanovski

Original Message:
Sent: Wed April 22, 2020 04:07 PM
From: Bruno Oliveira
Subject: QDI 2.2.5 and Token

Thank you for your message. The problem was that in the custom certificate there was the hostname but not the FQDN in the alt_extensions .

------------------------------
Bruno Oliveira

Original Message:
Sent: Thu April 09, 2020 12:00 PM
From: Paul Teichmann
Subject: QDI 2.2.5 and Token

Hi Bruno,

I recently got the same issue. The problem we had, was that our custom ssl certificate was not in the trust store.
So you should copy the correct certificate to /etc/pki/ca-trust/source/anchors/ on the system where the apps are running and then execute update-ca-trust. Newer versions of apps no longer ignore certificate issues.

I hope this solution also works for you.


Regards,

Paul
Original Message:
Sent: Tue April 07, 2020 09:22 AM
From: Bruno Oliveira
Subject: QDI 2.2.5 and Token

Hi Community,

before the Forum Migration there was a topic regarding the Token problem using QDI 2.2.5. I can't find this topic here. Therefore I ask the same question:

When I try to configure the SEC Token, I get the following error.

"WARNING: REST API accessf ails with the provided token. Please verify if the token has Admin access and is deployed"

already tried different tokens and deployed a couple of times. Tokens also work with other applications and REST API.

Is a case the only solution?

I have Qradar 7.3.3 FP1

Thank you

regards,

Bruno

------------------------------
Bruno Oliveira
------------------------------