feat(openldap): LDAP authentication integration (OpenLDAP / Active Directory)
LDAP authentication over the ldap3 library, designed to run on a remote engine inside the directory network. Auto-detects the vendor (OpenLDAP or Active Directory). 5 commands: test connection, ad-authenticate (simple bind), ad-groups (fetch all or specific groups), ad-authenticate-and-roles (bind + return the user's groups and attributes), and ad-entries-search (generic LDAP search with cn/uid/objectClass/description filters, scope, attribute selection and paging). Scripts share a ported LdapClient that handles SSL/LDAPS/Start TLS, vendor detection, OpenLDAP vs AD group/role resolution and paged search. ldap3 is imported defensively with a clear "pip install ldap3" message when missing. No ingestion source, so no OCSF mapper. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Guillaume BOURGEOIS
@@ -0,0 +1,151 @@
|
||||
id: openldap
|
||||
name: OpenLDAP
|
||||
version: 1.0.0
|
||||
description: "LDAP authentication for OpenLDAP or Active Directory — simple bind, fetch groups, authenticate-and-resolve-roles, and a generic LDAP entries search. Vendor is auto-detected. Runs on a remote engine inside the LDAP network. Requires the Python 'ldap3' library on the engine host (pip install ldap3)."
|
||||
changelog: "1.0.0 — Initial release: ad-authenticate (simple bind), ad-groups (fetch all or specific groups), ad-authenticate-and-roles (bind + return the user's groups and attributes), ad-entries-search (generic LDAP search). Supports OpenLDAP and Active Directory with automatic vendor detection."
|
||||
category: identity
|
||||
|
||||
# Per-instance configuration. Binds to an LDAP server (OpenLDAP or Active
|
||||
# Directory) over plain LDAP (389), LDAPS (636) or Start TLS. Run this integration
|
||||
# on a remote engine that can reach the directory. The bundled scripts require the
|
||||
# Python 'ldap3' library on the engine host: pip install ldap3
|
||||
config_schema:
|
||||
properties:
|
||||
ldap_server_vendor:
|
||||
type: string
|
||||
description: "LDAP vendor: OpenLDAP, Active Directory, or Auto (detect automatically). Default Auto."
|
||||
default: Auto
|
||||
host:
|
||||
type: string
|
||||
description: "LDAP server IP or host name (e.g. 192.168.0.1 or ldap.company.com)"
|
||||
port:
|
||||
type: string
|
||||
description: "Port. Default 389 (LDAP / Start TLS) or 636 (LDAPS)."
|
||||
username:
|
||||
type: string
|
||||
description: "Bind user DN (e.g. cn=admin,ou=users,dc=domain,dc=com)"
|
||||
password:
|
||||
type: string
|
||||
description: "Bind password"
|
||||
x-soar-sensitive: true
|
||||
base_dn:
|
||||
type: string
|
||||
description: "Base DN (e.g. dc=domain,dc=com)"
|
||||
connection_type:
|
||||
type: string
|
||||
description: "Connection security: None, SSL (LDAPS), or Start TLS. Default None."
|
||||
default: None
|
||||
ssl_version:
|
||||
type: string
|
||||
description: "SSL/TLS protocol: None, TLS, TLSv1, TLSv1_1, TLSv1_2, or TLS_CLIENT. Default None."
|
||||
default: None
|
||||
insecure:
|
||||
type: boolean
|
||||
description: "Trust any TLS certificate (not secure)"
|
||||
default: false
|
||||
page_size:
|
||||
type: string
|
||||
description: "LDAP paging size for searches"
|
||||
default: "500"
|
||||
fetch_groups:
|
||||
type: boolean
|
||||
description: "Auto-populate groups in ad-groups when no specific group is requested"
|
||||
default: true
|
||||
group_filter_class:
|
||||
type: string
|
||||
description: "Groups object class (OpenLDAP only)"
|
||||
default: posixGroup
|
||||
group_identifier_attribute:
|
||||
type: string
|
||||
description: "Groups unique identifier attribute (OpenLDAP only)"
|
||||
default: gidNumber
|
||||
member_identifier_attribute:
|
||||
type: string
|
||||
description: "Group membership identifier attribute (OpenLDAP only)"
|
||||
default: memberUid
|
||||
user_filter_class:
|
||||
type: string
|
||||
description: "User object class (OpenLDAP only)"
|
||||
default: posixAccount
|
||||
user_identifier_attribute:
|
||||
type: string
|
||||
description: "User unique identifier attribute (OpenLDAP only)"
|
||||
default: uid
|
||||
custom_attributes:
|
||||
type: string
|
||||
description: "Extra user attributes added to the user filter in ad-authenticate-and-roles, as 'attrA=valA,attrB=valB' (OpenLDAP only)"
|
||||
required:
|
||||
- ldap_server_vendor
|
||||
- host
|
||||
- username
|
||||
- password
|
||||
- base_dn
|
||||
- connection_type
|
||||
|
||||
commands:
|
||||
- id: test_connection
|
||||
name: ad-test-connection
|
||||
description: "Bind to the LDAP server with the configured credentials (used by the Test button)."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties: {}
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
- id: ad_authenticate
|
||||
name: ad-authenticate
|
||||
description: "Perform a simple bind on the LDAP server with the given username and password."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
username: { type: string, description: "Username for simple authentication" }
|
||||
password: { type: string, description: "Password for simple authentication", x-soar-sensitive: true }
|
||||
required: [username, password]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
- id: ad_groups
|
||||
name: ad-groups
|
||||
description: "Fetch LDAP groups under the base DN, or a specific set of groups (DNs delimited by '#')."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
specific-groups: { type: string, description: "Group object names/DNs to fetch, delimited by a number sign (#)" }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
- id: ad_authenticate_and_roles
|
||||
name: ad-authenticate-and-roles
|
||||
description: "Simple bind on the LDAP server and return the authenticated user's groups and selected attributes."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
username: { type: string, description: "Username for simple authentication" }
|
||||
password: { type: string, description: "Password for simple authentication", x-soar-sensitive: true }
|
||||
attribute-mail: { type: string, description: "Mail attribute to return (default mail)" }
|
||||
attribute-name: { type: string, description: "Name attribute to return (default name)" }
|
||||
attribute-phone: { type: string, description: "Phone attribute to return (default mobile)" }
|
||||
attribute-name-pull: { type: string, description: "Return the name attribute (default true)" }
|
||||
attribute-mail-pull: { type: string, description: "Return the mail attribute (default true)" }
|
||||
attribute-phone-pull: { type: string, description: "Return the phone attribute (default false)" }
|
||||
required: [username, password]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
- id: ad_entries_search
|
||||
name: ad-entries-search
|
||||
description: "Generic LDAP search. Combine raw search_filter with cn/uid/object_class/description filters (joined with OR), choose scope and attributes, and page the results."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
search_base: { type: string, description: "Where the search starts (defaults to the instance base_dn)" }
|
||||
search_filter: { type: string, description: "Raw LDAP filter; joined with the other filter args using OR" }
|
||||
search_scope: { type: string, description: "BASE, LEVEL or SUBTREE (default SUBTREE)" }
|
||||
attributes: { type: string, description: "none, all_user_attributes, all_operational_attributes, all, or a CSV list (default all)" }
|
||||
cn: { type: string, description: "CSV list of CNs to filter by (joined with AND)" }
|
||||
uid: { type: string, description: "CSV list of UIDs to filter by (joined with AND)" }
|
||||
object_class: { type: string, description: "CSV list of objectClasses to filter by (joined with AND)" }
|
||||
description: { type: string, description: "CSV list of descriptions to filter by (joined with AND)" }
|
||||
page: { type: number, description: "Page number to return" }
|
||||
page_size: { type: number, description: "Entries per page (max 2000, default 50)" }
|
||||
limit: { type: number, description: "Maximum entries to return when not paging (default 50)" }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
Reference in New Issue
Block a user