diff --git a/.github/workflows/generate-doc.yml b/.github/workflows/generate-doc.yml new file mode 100644 index 0000000..9284f9d --- /dev/null +++ b/.github/workflows/generate-doc.yml @@ -0,0 +1,20 @@ +name: Generate Readme Doc +on: + workflow_dispatch: + push: + paths: + - '*.json' + - 'readme.html' + - 'manual_readme_content.md' + tags-ignore: + - '**' + branches-ignore: + - next + - main +jobs: + generate-doc: + runs-on: ubuntu-latest + steps: + - uses: 'phantomcyber/dev-cicd-tools/github-actions/generate-doc@main' + with: + GITHUB_TOKEN: ${{ secrets.SOAR_APPS_TOKEN }} diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index ad343aa..97a8333 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,6 +1,6 @@ repos: - repo: https://github.com/phantomcyber/dev-cicd-tools - rev: v1.13 + rev: v1.16 hooks: - id: org-hook - id: package-app-dependencies diff --git a/LICENSE b/LICENSE index 53ef397..b8242ac 100644 --- a/LICENSE +++ b/LICENSE @@ -186,7 +186,7 @@ same "printed page" as the copyright notice for easier identification within third-party archives. - Copyright (c) 2021-2022 Splunk Inc. + Copyright (c) 2021-2023 Splunk Inc. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/NOTICE b/NOTICE index aae176f..c40ea54 100644 --- a/NOTICE +++ b/NOTICE @@ -1,5 +1,5 @@ Splunk SOAR AD LDAP -Copyright (c) 2021-2022 Splunk Inc. +Copyright (c) 2021-2023 Splunk Inc. Third-party Software Attributions: @@ -12,8 +12,3 @@ Library: pyasn1 Version: 0.4.7 License: BSD 2 Copyright 2005-2019 Ilya Etingof - -Library: requests -Version: 2.25.0 -License: Apache 2.0 -Kenneth Reitz diff --git a/README.md b/README.md index fd82853..1eed9cc 100644 --- a/README.md +++ b/README.md @@ -2,16 +2,16 @@ # AD LDAP Publisher: Splunk -Connector Version: 2\.2\.0 +Connector Version: 2.2.1 Product Vendor: Splunk Product Name: Active Directory LDAP -Product Version Supported (regex): "\.\*" -Minimum Product Version: 5\.3\.5 +Product Version Supported (regex): ".\*" +Minimum Product Version: 5.3.5 App specifically designed for interacting with Microsoft Active Directory's LDAP Implementation [comment]: # " File: README.md" -[comment]: # " Copyright (c) 2021-2022 Splunk Inc." +[comment]: # " Copyright (c) 2021-2023 Splunk Inc." [comment]: # " Licensed under the Apache License, Version 2.0 (the 'License');" [comment]: # " you may not use this file except in compliance with the License." [comment]: # " You may obtain a copy of the License at" @@ -93,7 +93,7 @@ that you would like to return. - - filter = (\|(mail=\*)(samaccountname=\*admin\*)) + - filter = (|(mail=\*)(samaccountname=\*admin\*)) - attributes = samaccountname;mail;userprincipalname;distinguishedname - If you would like to learn more about LDAP Filter Syntax, check out this [Microsoft @@ -110,9 +110,9 @@ VARIABLE | REQUIRED | TYPE | DESCRIPTION **server** | required | string | The Active Directory Server hostname, IP, or VIP for binding **username** | required | string | The username with which to bind to LDAP **password** | required | password | The password for the binding user -**force\_ssl** | optional | boolean | Force the use of SSL protocol\. Note that some actions are not possible without secure binding\! -**validate\_ssl\_cert** | optional | boolean | Select if you want to validate the LDAP SSL certificate -**ssl\_port** | required | numeric | The port to bind for SSL \(default 636\) +**force_ssl** | optional | boolean | Force the use of SSL protocol. Note that some actions are not possible without secure binding! +**validate_ssl_cert** | optional | boolean | Select if you want to validate the LDAP SSL certificate +**ssl_port** | required | numeric | The port to bind for SSL (default 636) ### Supported Actions [test connectivity](#action-test-connectivity) - Validate the asset configuration for connectivity using supplied configuration @@ -149,26 +149,26 @@ Read only: **False** #### Action Parameters PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS --------- | -------- | ----------- | ---- | -------- -**use\_samaccountname** | optional | Specify members AND groups as sAMAccountName\(s\) instead of distinguishedName\(s\) \(note\: member AND groups will use sAMAccountName if selected\) | boolean | -**members** | required | Semi\-colon \(';'\) separated list of users\. If 'use samaccountname' is false, then these must be distinguishedName\(s\) | string | -**groups** | required | Semi\-colon \(';'\) separated list of groups to which the members will be added\. If 'use samaccountname' is false, then these must be distinguishedName\(s\) | string | +**use_samaccountname** | optional | Specify members AND groups as sAMAccountName(s) instead of distinguishedName(s) (note: member AND groups will use sAMAccountName if selected) | boolean | +**members** | required | Semi-colon (';') separated list of users. If 'use samaccountname' is false, then these must be distinguishedName(s) | string | +**groups** | required | Semi-colon (';') separated list of groups to which the members will be added. If 'use samaccountname' is false, then these must be distinguishedName(s) | string | #### Action Output -DATA PATH | TYPE | CONTAINS ---------- | ---- | -------- -action\_result\.status | string | -action\_result\.parameter\.groups | string | -action\_result\.parameter\.members | string | -action\_result\.parameter\.use\_samaccountname | boolean | -action\_result\.data\.\*\.function | string | -action\_result\.data\.\*\.group | string | -action\_result\.data\.\*\.member | string | -action\_result\.summary | string | -action\_result\.summary\.found\_user\_records | numeric | -action\_result\.summary\.requested\_user\_records | numeric | -action\_result\.message | string | -summary\.total\_objects | numeric | -summary\.total\_objects\_successful | numeric | +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success failed +action_result.parameter.groups | string | | Domain Guests +action_result.parameter.members | string | | svc-test +action_result.parameter.use_samaccountname | boolean | | True False +action_result.data.\*.function | string | | added +action_result.data.\*.group | string | | cn=domain guests,cn=users,dc=test,dc=lab +action_result.data.\*.member | string | | cn=svc-test,ou=test,dc=test,dc=lab +action_result.summary | string | | +action_result.summary.found_user_records | numeric | | 1 +action_result.summary.requested_user_records | numeric | | 1 +action_result.message | string | | added member(s) to group(s) +summary.total_objects | numeric | | 1 +summary.total_objects_successful | numeric | | 1 ## action: 'remove group members' Removes one or more Active Directory objects from one or more groups @@ -179,26 +179,26 @@ Read only: **False** #### Action Parameters PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS --------- | -------- | ----------- | ---- | -------- -**use\_samaccountname** | optional | Specify members AND groups as sAMAccountName\(s\) instead of distinguishedName\(s\) | boolean | -**members** | required | Semi\-colon \(';'\) separated list of users\. If 'use samaccountname' is false, then these must be distinguishedName\(s\) | string | -**groups** | required | Semi\-colon \(';'\) separated list of groups from which the members will be removed\. If 'use samaccountname' is false, then these must be distinguishedName\(s\) | string | +**use_samaccountname** | optional | Specify members AND groups as sAMAccountName(s) instead of distinguishedName(s) | boolean | +**members** | required | Semi-colon (';') separated list of users. If 'use samaccountname' is false, then these must be distinguishedName(s) | string | +**groups** | required | Semi-colon (';') separated list of groups from which the members will be removed. If 'use samaccountname' is false, then these must be distinguishedName(s) | string | #### Action Output -DATA PATH | TYPE | CONTAINS ---------- | ---- | -------- -action\_result\.status | string | -action\_result\.parameter\.groups | string | -action\_result\.parameter\.members | string | -action\_result\.parameter\.use\_samaccountname | boolean | -action\_result\.data\.\*\.function | string | -action\_result\.data\.\*\.group | string | -action\_result\.data\.\*\.member | string | -action\_result\.summary | string | -action\_result\.summary\.found\_user\_records | numeric | -action\_result\.summary\.requested\_user\_records | numeric | -action\_result\.message | string | -summary\.total\_objects | numeric | -summary\.total\_objects\_successful | numeric | +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success failed +action_result.parameter.groups | string | | Domain Guests +action_result.parameter.members | string | | svc-test +action_result.parameter.use_samaccountname | boolean | | True False +action_result.data.\*.function | string | | removed +action_result.data.\*.group | string | | cn=domain guests,cn=users,dc=test,dc=lab +action_result.data.\*.member | string | | cn=svc-test,ou=test,dc=test,dc=lab +action_result.summary | string | | +action_result.summary.found_user_records | numeric | | 1 +action_result.summary.requested_user_records | numeric | | 1 +action_result.message | string | | removed member(s) from group(s) +summary.total_objects | numeric | | 1 +summary.total_objects_successful | numeric | | 1 ## action: 'unlock account' Unlocks a locked Active Directory account @@ -209,23 +209,23 @@ Read only: **False** #### Action Parameters PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS --------- | -------- | ----------- | ---- | -------- -**use\_samaccountname** | optional | Use sAMAccountName for user instead of distinguishedName\(s\) | boolean | -**user** | required | Specify the user to unlock\. If 'use samaccountname' is false, then this must be the user's distinguishedName | string | `user name` +**use_samaccountname** | optional | Use sAMAccountName for user instead of distinguishedName(s) | boolean | +**user** | required | Specify the user to unlock. If 'use samaccountname' is false, then this must be the user's distinguishedName | string | `user name` #### Action Output -DATA PATH | TYPE | CONTAINS ---------- | ---- | -------- -action\_result\.status | string | -action\_result\.parameter\.use\_samaccountname | boolean | -action\_result\.parameter\.user | string | `user name` -action\_result\.data\.\*\.samaccountname | string | -action\_result\.data\.\*\.unlocked | boolean | -action\_result\.data\.\*\.user\_dn | string | -action\_result\.summary | string | -action\_result\.summary\.unlocked | numeric | -action\_result\.message | string | -summary\.total\_objects | numeric | -summary\.total\_objects\_successful | numeric | +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success failed +action_result.parameter.use_samaccountname | boolean | | True False +action_result.parameter.user | string | `user name` | CN=DEFAULTACCOUNT,CN=USERS,DC=TEST,DC=LAB +action_result.data.\*.samaccountname | string | | +action_result.data.\*.unlocked | boolean | | True +action_result.data.\*.user_dn | string | | cn=defaultaccount,cn=users,dc=test,dc=lab +action_result.summary | string | | +action_result.summary.unlocked | numeric | | True +action_result.message | string | | Unlocked: True +summary.total_objects | numeric | | 1 +summary.total_objects_successful | numeric | | 1 ## action: 'disable account' Disables an Active Directory account @@ -236,21 +236,21 @@ Read only: **False** #### Action Parameters PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS --------- | -------- | ----------- | ---- | -------- -**use\_samaccountname** | optional | Specify sAMAccountName instead of distinguishedName | boolean | -**user** | required | Specify the user to disable\. If 'use samaccountname' is false, then this must be the user's distinguishedName | string | `user name` +**use_samaccountname** | optional | Specify sAMAccountName instead of distinguishedName | boolean | +**user** | required | Specify the user to disable. If 'use samaccountname' is false, then this must be the user's distinguishedName | string | `user name` #### Action Output -DATA PATH | TYPE | CONTAINS ---------- | ---- | -------- -action\_result\.status | string | -action\_result\.parameter\.use\_samaccountname | boolean | -action\_result\.parameter\.user | string | `user name` -action\_result\.data\.\*\.starting\_status | string | -action\_result\.data\.\*\.user\_dn | string | -action\_result\.summary\.account\_status | string | -action\_result\.message | string | -summary\.total\_objects | numeric | -summary\.total\_objects\_successful | numeric | +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success failed +action_result.parameter.use_samaccountname | boolean | | True False +action_result.parameter.user | string | `user name` | CN=DEFAULTACCOUNT,CN=USERS,DC=TEST,DC=LAB +action_result.data.\*.starting_status | string | | enabled +action_result.data.\*.user_dn | string | | cn=defaultaccount,cn=users,dc=test,dc=lab +action_result.summary.account_status | string | | disabled +action_result.message | string | | Account status: disabled +summary.total_objects | numeric | | 1 +summary.total_objects_successful | numeric | | 1 ## action: 'enable account' Enables a disabled Active Directory account @@ -261,21 +261,21 @@ Read only: **False** #### Action Parameters PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS --------- | -------- | ----------- | ---- | -------- -**use\_samaccountname** | optional | Specify sAMAccountName instead of distinguishedName | boolean | -**user** | required | Specify the user to enable\. If 'use samaccountname' is false, then this must be the user's distinguishedName | string | `user name` +**use_samaccountname** | optional | Specify sAMAccountName instead of distinguishedName | boolean | +**user** | required | Specify the user to enable. If 'use samaccountname' is false, then this must be the user's distinguishedName | string | `user name` #### Action Output -DATA PATH | TYPE | CONTAINS ---------- | ---- | -------- -action\_result\.status | string | -action\_result\.parameter\.use\_samaccountname | boolean | -action\_result\.parameter\.user | string | `user name` -action\_result\.data\.\*\.starting\_status | string | -action\_result\.data\.\*\.user\_dn | string | -action\_result\.summary\.account\_status | string | -action\_result\.message | string | -summary\.total\_objects | numeric | -summary\.total\_objects\_successful | numeric | +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success failed +action_result.parameter.use_samaccountname | boolean | | True False +action_result.parameter.user | string | `user name` | CN=DEFAULTACCOUNT,CN=USERS,DC=TEST,DC=LAB +action_result.data.\*.starting_status | string | | disabled +action_result.data.\*.user_dn | string | | cn=defaultaccount,cn=users,dc=test,dc=lab +action_result.summary.account_status | string | | enabled +action_result.message | string | | Account status: enabled +summary.total_objects | numeric | | 1 +summary.total_objects_successful | numeric | | 1 ## action: 'reset password' Resets the password of a user, requiring the user to change password at next login @@ -286,22 +286,22 @@ Read only: **False** #### Action Parameters PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS --------- | -------- | ----------- | ---- | -------- -**use\_samaccountname** | optional | Use sAMAccountName instead of distinguishedName | boolean | +**use_samaccountname** | optional | Use sAMAccountName instead of distinguishedName | boolean | **user** | required | User whose attributes are to be modified | string | `user name` #### Action Output -DATA PATH | TYPE | CONTAINS ---------- | ---- | -------- -action\_result\.status | string | -action\_result\.parameter\.use\_samaccountname | boolean | -action\_result\.parameter\.user | string | `user name` -action\_result\.data\.\*\.reset | numeric | -action\_result\.data\.\*\.samaccountname | string | -action\_result\.data\.\*\.user\_dn | string | -action\_result\.summary\.reset | numeric | -action\_result\.message | string | -summary\.total\_objects | numeric | -summary\.total\_objects\_successful | numeric | +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success failed +action_result.parameter.use_samaccountname | boolean | | True False +action_result.parameter.user | string | `user name` | SVC-TEST +action_result.data.\*.reset | numeric | | True +action_result.data.\*.samaccountname | string | | SVC-TEST +action_result.data.\*.user_dn | string | | CN=SVC-TEST,OU=TEST,DC=TEST,DC=LAB +action_result.summary.reset | numeric | | True +action_result.message | string | | Reset: True +summary.total_objects | numeric | | 1 +summary.total_objects_successful | numeric | | 1 ## action: 'set password' Set a user's password @@ -312,27 +312,27 @@ Read only: **False** #### Action Parameters PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS --------- | -------- | ----------- | ---- | -------- -**use\_samaccountname** | optional | Specify sAMAccountName instead of distinguishedName | boolean | -**user** | required | Specify the user whose password will be set\. If 'use samaccountname' is false, then this must be the user's distinguishedName | string | `user name` +**use_samaccountname** | optional | Specify sAMAccountName instead of distinguishedName | boolean | +**user** | required | Specify the user whose password will be set. If 'use samaccountname' is false, then this must be the user's distinguishedName | string | `user name` **password** | required | New password | string | -**confirm\_password** | required | Re\-type the password | string | +**confirm_password** | required | Re-type the password | string | #### Action Output -DATA PATH | TYPE | CONTAINS ---------- | ---- | -------- -action\_result\.status | string | -action\_result\.parameter\.confirm\_password | string | -action\_result\.parameter\.password | string | -action\_result\.parameter\.use\_samaccountname | boolean | -action\_result\.parameter\.user | string | `user name` -action\_result\.data\.\*\.samaccountname | string | -action\_result\.data\.\*\.set | boolean | -action\_result\.data\.\*\.user\_dn | string | -action\_result\.summary | string | -action\_result\.summary\.set | numeric | -action\_result\.message | string | -summary\.total\_objects | numeric | -summary\.total\_objects\_successful | numeric | +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success failed +action_result.parameter.confirm_password | string | | Thisisanewpw!123 +action_result.parameter.password | string | | Thisisanewpw!123 +action_result.parameter.use_samaccountname | boolean | | True False +action_result.parameter.user | string | `user name` | CN=DEFAULTACCOUNT,CN=USERS,DC=TEST,DC=LAB +action_result.data.\*.samaccountname | string | | +action_result.data.\*.set | boolean | | True +action_result.data.\*.user_dn | string | | cn=defaultaccount,cn=users,dc=test,dc=lab +action_result.summary | string | | +action_result.summary.set | numeric | | True +action_result.message | string | | Set: True +summary.total_objects | numeric | | 1 +summary.total_objects_successful | numeric | | 1 ## action: 'move object' Moves an entry in Active Directory @@ -344,20 +344,20 @@ Read only: **False** PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS --------- | -------- | ----------- | ---- | -------- **object** | required | Specify the distinguishedName to move | string | -**destination\_ou** | required | The distinguishedName of the OU the specified object will move to | string | +**destination_ou** | required | The distinguishedName of the OU the specified object will move to | string | #### Action Output -DATA PATH | TYPE | CONTAINS ---------- | ---- | -------- -action\_result\.status | string | -action\_result\.parameter\.destination\_ou | string | -action\_result\.parameter\.object | string | -action\_result\.data\.\*\.destination\_container | string | -action\_result\.data\.\*\.source\_object | string | -action\_result\.summary\.moved | string | -action\_result\.message | string | -summary\.total\_objects | numeric | -summary\.total\_objects\_successful | numeric | +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success failed +action_result.parameter.destination_ou | string | | OU=TEST,DC=TEST,DC=LAB +action_result.parameter.object | string | | CN=SVC-TEST,OU=TEST,DC=TEST,DC=LAB +action_result.data.\*.destination_container | string | | OU=TEST,DC=TEST,DC=LAB +action_result.data.\*.source_object | string | | CN=SVC-TEST,OU=TEST,DC=TEST,DC=LAB +action_result.summary.moved | string | | True +action_result.message | string | | Moved: True +summary.total_objects | numeric | | 1 +summary.total_objects_successful | numeric | | 1 ## action: 'run query' Query Active Directory LDAP @@ -365,29 +365,29 @@ Query Active Directory LDAP Type: **investigate** Read only: **True** -This action flexibly supports querying Active Directory using LDAP syntax\. +This action flexibly supports querying Active Directory using LDAP syntax. #### Action Parameters PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS --------- | -------- | ----------- | ---- | -------- -**filter** | required | The LDAP filter \(must be in LDAP Syntax\) | string | -**search\_base** | optional | The search base to use in its distinguishedName format\. If not specified, the 'defaultNamingContext' will be used | string | -**attributes** | required | Semi\-colon separated list of attributes to collect \(e\.g\. sAMAccountName;mail\) | string | +**filter** | required | The LDAP filter (must be in LDAP Syntax) | string | +**search_base** | optional | The search base to use in its distinguishedName format. If not specified, the 'defaultNamingContext' will be used | string | +**attributes** | required | Semi-colon separated list of attributes to collect (e.g. sAMAccountName;mail) | string | #### Action Output -DATA PATH | TYPE | CONTAINS ---------- | ---- | -------- -action\_result\.status | string | -action\_result\.parameter\.attributes | string | -action\_result\.parameter\.filter | string | -action\_result\.parameter\.search\_base | string | -action\_result\.data\.\*\.entries\.\*\.attributes | string | -action\_result\.data\.\*\.entries\.\*\.attributes\.samaccountname | string | -action\_result\.data\.\*\.entries\.\*\.dn | string | -action\_result\.summary\.total\_objects | numeric | -action\_result\.message | string | -summary\.total\_objects | numeric | -summary\.total\_objects\_successful | numeric | +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success failed +action_result.parameter.attributes | string | | sAMAccountName +action_result.parameter.filter | string | | (sAMAccountName=\*) +action_result.parameter.search_base | string | | ou=test,dc=test,dc=lab +action_result.data.\*.entries.\*.attributes | string | | +action_result.data.\*.entries.\*.attributes.samaccountname | string | | SVC-TEST +action_result.data.\*.entries.\*.dn | string | | CN=SVC-TEST,OU=TEST,DC=TEST,DC=LAB +action_result.summary.total_objects | numeric | | 1 +action_result.message | string | | Total objects: 1 +summary.total_objects | numeric | | 1 +summary.total_objects_successful | numeric | | 1 ## action: 'get attributes' Get attributes of various principals @@ -395,28 +395,28 @@ Get attributes of various principals Type: **investigate** Read only: **True** -This action takes any number of principals \(sAMAccountName, distinguishedName, or userprincipalname\) and returns requested attributes\. Separate with semi\-colon \(';'\)\. +This action takes any number of principals (sAMAccountName, distinguishedName, or userprincipalname) and returns requested attributes. Separate with semi-colon (';'). #### Action Parameters PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS --------- | -------- | ----------- | ---- | -------- -**principals** | required | The semi\-colon separated principals\. These can be sAMAccountName, userprincipalname, or distinguishedName | string | -**attributes** | required | Semi\-colon separated list of attributes to collect | string | +**principals** | required | The semi-colon separated principals. These can be sAMAccountName, userprincipalname, or distinguishedName | string | +**attributes** | required | Semi-colon separated list of attributes to collect | string | #### Action Output -DATA PATH | TYPE | CONTAINS ---------- | ---- | -------- -action\_result\.status | string | -action\_result\.parameter\.attributes | string | -action\_result\.parameter\.principals | string | -action\_result\.data\.\*\.entries\.\*\.attributes | string | -action\_result\.data\.\*\.entries\.\*\.attributes\.objectGUID | string | -action\_result\.data\.\*\.entries\.\*\.dn | string | -action\_result\.summary | string | -action\_result\.summary\.total\_objects | numeric | -action\_result\.message | string | -summary\.total\_objects | numeric | -summary\.total\_objects\_successful | numeric | +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success failed +action_result.parameter.attributes | string | | ObjectGUID +action_result.parameter.principals | string | | SVC-TEST;defaultaccount +action_result.data.\*.entries.\*.attributes | string | | +action_result.data.\*.entries.\*.attributes.objectGUID | string | | {a6c536dd-2487-41dd-8524-0037342505da} +action_result.data.\*.entries.\*.dn | string | | CN=SVC-TEST,OU=test,DC=TEST,DC=LAB +action_result.summary | string | | +action_result.summary.total_objects | numeric | | 2 +action_result.message | string | | Total objects: 2 +summary.total_objects | numeric | | 1 +summary.total_objects_successful | numeric | | 1 ## action: 'set attribute' Add, delete, or replace an attribute of a user @@ -427,23 +427,23 @@ Read only: **False** #### Action Parameters PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS --------- | -------- | ----------- | ---- | -------- -**use\_samaccountname** | optional | Use sAMAccountName instead of distinguishedName | boolean | +**use_samaccountname** | optional | Use sAMAccountName instead of distinguishedName | boolean | **user** | required | User whose attributes are to be modified | string | `user name` -**attribute** | required | The attribute to modify \(add/delete/replace\) | string | +**attribute** | required | The attribute to modify (add/delete/replace) | string | **value** | optional | Attribute value | string | -**action** | required | Semi\-colon separated list of attributes to collect | string | +**action** | required | Semi-colon separated list of attributes to collect | string | #### Action Output -DATA PATH | TYPE | CONTAINS ---------- | ---- | -------- -action\_result\.status | string | -action\_result\.parameter\.action | string | -action\_result\.parameter\.attribute | string | -action\_result\.parameter\.use\_samaccountname | boolean | -action\_result\.parameter\.user | string | `user name` -action\_result\.parameter\.value | string | -action\_result\.data\.\*\.message | string | -action\_result\.summary\.summary | string | -action\_result\.message | string | -summary\.total\_objects | numeric | -summary\.total\_objects\_successful | numeric | \ No newline at end of file +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success failed +action_result.parameter.action | string | | REPLACE +action_result.parameter.attribute | string | | mail +action_result.parameter.use_samaccountname | boolean | | True False +action_result.parameter.user | string | `user name` | Cn=SVC-TEST,OU=TEST,DC=TEST,DC=LAB +action_result.parameter.value | string | | svc_test@test.com +action_result.data.\*.message | string | | Success +action_result.summary.summary | string | | Successfully Set Attributes +action_result.message | string | | Summary: Successfully Set Attributes +summary.total_objects | numeric | | 1 +summary.total_objects_successful | numeric | | 1 \ No newline at end of file diff --git a/__init__.py b/__init__.py index a3461fb..4ec5d51 100644 --- a/__init__.py +++ b/__init__.py @@ -1,6 +1,6 @@ # File: __init__.py # -# Copyright (c) 2021-2022 Splunk Inc. +# Copyright (c) 2021-2023 Splunk Inc. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. diff --git a/adldap.json b/adldap.json index 59855f9..5bde66b 100644 --- a/adldap.json +++ b/adldap.json @@ -9,8 +9,8 @@ "product_name": "Active Directory LDAP", "product_version_regex": ".*", "publisher": "Splunk", - "license": "Copyright (c) 2021-2022 Splunk Inc.", - "app_version": "2.2.0", + "license": "Copyright (c) 2021-2023 Splunk Inc.", + "app_version": "2.2.1", "utctime_updated": "2022-01-20T22:27:39.000000Z", "package_name": "phantom_adldap", "main_module": "adldap_connector.py", @@ -23,18 +23,6 @@ ], "pip_dependencies": { "wheel": [ - { - "module": "certifi", - "input_file": "wheels/py3/certifi-2022.9.24-py3-none-any.whl" - }, - { - "module": "chardet", - "input_file": "wheels/shared/chardet-3.0.4-py2.py3-none-any.whl" - }, - { - "module": "idna", - "input_file": "wheels/shared/idna-2.10-py2.py3-none-any.whl" - }, { "module": "ldap3", "input_file": "wheels/shared/ldap3-2.6.1-py2.py3-none-any.whl" @@ -42,14 +30,6 @@ { "module": "pyasn1", "input_file": "wheels/shared/pyasn1-0.4.7-py2.py3-none-any.whl" - }, - { - "module": "requests", - "input_file": "wheels/shared/requests-2.25.0-py2.py3-none-any.whl" - }, - { - "module": "urllib3", - "input_file": "wheels/shared/urllib3-1.26.12-py2.py3-none-any.whl" } ] }, diff --git a/adldap_connector.py b/adldap_connector.py index 943f272..9ad411f 100644 --- a/adldap_connector.py +++ b/adldap_connector.py @@ -1,6 +1,6 @@ # File: adldap_connector.py # -# Copyright (c) 2021-2022 Splunk Inc. +# Copyright (c) 2021-2023 Splunk Inc. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. diff --git a/adldap_consts.py b/adldap_consts.py index 517db06..7d177cc 100644 --- a/adldap_consts.py +++ b/adldap_consts.py @@ -1,6 +1,6 @@ # File: adldap_consts.py # -# Copyright (c) 2021-2022 Splunk Inc. +# Copyright (c) 2021-2023 Splunk Inc. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. diff --git a/adldap_view.py b/adldap_view.py index 8f635a0..ceed387 100644 --- a/adldap_view.py +++ b/adldap_view.py @@ -1,6 +1,6 @@ # File: adldap_view.py # -# Copyright (c) 2021-2022 Splunk Inc. +# Copyright (c) 2021-2023 Splunk Inc. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. diff --git a/display_attributes.html b/display_attributes.html index 5f25648..b2a99e5 100644 --- a/display_attributes.html +++ b/display_attributes.html @@ -10,7 +10,7 @@ {% block widget_content %} - - - -

App Information

- - -

LDAP Ports Requirements (Based on Standard Guidelines of IANA ORG)

- - -

Asset Configuration

- - The asset for this app requires an account with which to Bind and perform actions. If you are only ever going to perform information gathering tasks - (e.g. getting account attributes) then a standard user account would be fine. However, if you plan on doing things like Unlocking, - Resetting Passwords, Moving objects, etc. - then you will need an account with permissions to actually perform these actions. - It is best practice to NOT use a "Domain Administrator" (or higher) account. Instead, delegate the appropriate least-privilege access - to a service account with a very strong password. Lastly, it is strongly recommended to use SSL and disallow insecure (plain text and unsigned binds) - if at all possible. - -

To add a custom certificate to the certificate store, follow the below steps:

- - Note: For reference: Splunk Docs - -

Run Query Action

- This action provides the user the ability to run generic queries with the LDAP syntax. The action takes a filter (in LDAP syntax), an optional - search base to search within, and specific attributes that you would like to return. - -
- - - diff --git a/release_notes/2.2.1.md b/release_notes/2.2.1.md new file mode 100644 index 0000000..7549a0c --- /dev/null +++ b/release_notes/2.2.1.md @@ -0,0 +1 @@ +* Updated requests and certifi dependencies in order to use platform packages [PAPP-30822,PAPP-31096] \ No newline at end of file diff --git a/requirements.txt b/requirements.txt index 1b7d91b..ef6dbfb 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,3 +1,2 @@ ldap3==2.6.1 pyasn1==0.4.7 -requests==2.25.0 diff --git a/wheels/py3/certifi-2022.9.24-py3-none-any.whl b/wheels/py3/certifi-2022.9.24-py3-none-any.whl deleted file mode 100644 index d32fe4f..0000000 Binary files a/wheels/py3/certifi-2022.9.24-py3-none-any.whl and /dev/null differ diff --git a/wheels/shared/chardet-3.0.4-py2.py3-none-any.whl b/wheels/shared/chardet-3.0.4-py2.py3-none-any.whl deleted file mode 100644 index d276977..0000000 Binary files a/wheels/shared/chardet-3.0.4-py2.py3-none-any.whl and /dev/null differ diff --git a/wheels/shared/idna-2.10-py2.py3-none-any.whl b/wheels/shared/idna-2.10-py2.py3-none-any.whl deleted file mode 100644 index 41225cb..0000000 Binary files a/wheels/shared/idna-2.10-py2.py3-none-any.whl and /dev/null differ diff --git a/wheels/shared/requests-2.25.0-py2.py3-none-any.whl b/wheels/shared/requests-2.25.0-py2.py3-none-any.whl deleted file mode 100644 index c3f28e5..0000000 Binary files a/wheels/shared/requests-2.25.0-py2.py3-none-any.whl and /dev/null differ diff --git a/wheels/shared/urllib3-1.26.12-py2.py3-none-any.whl b/wheels/shared/urllib3-1.26.12-py2.py3-none-any.whl deleted file mode 100644 index 6590a02..0000000 Binary files a/wheels/shared/urllib3-1.26.12-py2.py3-none-any.whl and /dev/null differ