OpenLDAP
OpenLDAP Pack.#
This Integration is part of the#
OverviewThis integration enables using your OpenLDAP user authentication settings in Cortex XSOAR. Users can log in to Cortex XSOAR with their OpenLDAP username and passwords, and their permissions in Cortex XSOAR will be set according to the groups and mapping set in AD Roles Mapping.
#
Use CasesUse OpenLDAP user authentication groups to set user roles in Cortex XSOAR.
#
Configure OpenLDAP on Cortex XSOAR- Navigate to Settings > Integrations > Servers & Services.
- Search for OpenLDAP.
- Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- Server IP or Host Name (e.g., 192.168.0.1)
- Port. If not specified, default port is 389, or 636 for LDAPS.
- User DN (e.g cn=admin,ou=users,dc=domain,dc=com)
- Base DN (e.g. DC=domain,DC=com)
- Auto populate groups
- Groups Object Class
- Groups Unique Identifier Attribute
- Group Membership Identifier Attribute
- User Object Class
- User Unique Identifier Attribute
- Page size
- Connection Type
- Trust any certificate (not secure)
- Use system proxy settings
- Click Test to validate the URLs, token, and connection.
#
Additional InformationSteps required for setting AD roles Mapping:
- Create OpenLDAP child entry of User Account template under wanted Organizational Unit and Posix Group, with uid as part of DN:
- Create OpenLDAP child entry of Posix Group template, with created account from step 1 as memberUid:
If using different attributes and class/group templates (different objectClass), customize the following default values in the instance configuration:
- Groups Object Class
- Groups Unique Identifier Attribute
- Group Membership Identifier Attribute
- User Object Class
- User Unique Identifier Attribute
Navigate to Settings > USERS AND ROLES > ROLES.
Choose the role.
Add the created group from step 2 to AD Roles Mapping.
- Login to Cortex XSOAR using uid or full DN and password of the user created in step 1.
#
CommandsYou can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.
#
ad-authenticatePerforms a simple bind operation on the LDAP server.
#
Base Commandad-authenticate
#
InputArgument Name | Description | Required |
---|---|---|
username | The username for simple authentication. | Required |
password | The password for simple authentication. | Required |
#
Context OutputThere is no context output for this command.
#
Command Example!ad-authenticate username=user password=secret
#
Human Readable OutputDone
#
ad-groupsFetches LDAP groups under a given base DN.
#
Base Commandad-groups
#
InputArgument Name | Description | Required |
---|---|---|
specific-groups | A list of group object names to fetch. The list is delimited by a number sign (#). | Optional |
#
Context OutputThere is no context output for this command.
#
Command Example!ad-groups
#
Human Readable Output{ "Entries": { "Attributes": [ { "Name": "primaryGroupToken" } ] } }
#
ad-authenticate-and-rolesPerforms a simple bind operation on the LDAP server and returns the authenticated user's groups.
#
Base Commandad-authenticate-and-roles
#
InputArgument Name | Description | Required |
---|---|---|
username | The username for simple authentication. | Required |
password | The password for simple authentication. | Required |
attribute-mail-pull | Whether to return the mail attribute. Possible values are: "true", "false". Default is "true". | Optional |
attribute-mail | Mail attribute to return in the response. Default is "mail". | Optional |
attribute-name-pull | Whether to return the name attribute. Possible values are: "true", "false". Default is "true". | Optional |
attribute-name | Name attribute to return in the response. | Optional |
#
Context OutputThere is no context output for this command.
#
Command Example!ad-authenticate-and-roles
#
Human Readable Output{ "Entries": { "Attributes": [ { "Name": "primaryGroupToken" } ] } }