id: openldap
name: OpenLDAP
version: 1.0.0
description: "LDAP authentication for OpenLDAP or Active Directory — simple bind, fetch groups, authenticate-and-resolve-roles, and a generic LDAP entries search. Vendor is auto-detected. Runs on a remote engine inside the LDAP network. Requires the Python 'ldap3' library on the engine host (pip install ldap3)."
changelog: "1.0.0 — Initial release: ad-authenticate (simple bind), ad-groups (fetch all or specific groups), ad-authenticate-and-roles (bind + return the user's groups and attributes), ad-entries-search (generic LDAP search). Supports OpenLDAP and Active Directory with automatic vendor detection."
category: identity

# Per-instance configuration. Binds to an LDAP server (OpenLDAP or Active
# Directory) over plain LDAP (389), LDAPS (636) or Start TLS. Run this integration
# on a remote engine that can reach the directory. The bundled scripts require the
# Python 'ldap3' library on the engine host: pip install ldap3
config_schema:
  properties:
    ldap_server_vendor:
      type: string
      description: "LDAP vendor: OpenLDAP, Active Directory, or Auto (detect automatically). Default Auto."
      default: Auto
    host:
      type: string
      description: "LDAP server IP or host name (e.g. 192.168.0.1 or ldap.company.com)"
    port:
      type: string
      description: "Port. Default 389 (LDAP / Start TLS) or 636 (LDAPS)."
    username:
      type: string
      description: "Bind user DN (e.g. cn=admin,ou=users,dc=domain,dc=com)"
    password:
      type: string
      description: "Bind password"
      x-soar-sensitive: true
    base_dn:
      type: string
      description: "Base DN (e.g. dc=domain,dc=com)"
    connection_type:
      type: string
      description: "Connection security: None, SSL (LDAPS), or Start TLS. Default None."
      default: None
    ssl_version:
      type: string
      description: "SSL/TLS protocol: None, TLS, TLSv1, TLSv1_1, TLSv1_2, or TLS_CLIENT. Default None."
      default: None
    insecure:
      type: boolean
      description: "Trust any TLS certificate (not secure)"
      default: false
    page_size:
      type: string
      description: "LDAP paging size for searches"
      default: "500"
    fetch_groups:
      type: boolean
      description: "Auto-populate groups in ad-groups when no specific group is requested"
      default: true
    group_filter_class:
      type: string
      description: "Groups object class (OpenLDAP only)"
      default: posixGroup
    group_identifier_attribute:
      type: string
      description: "Groups unique identifier attribute (OpenLDAP only)"
      default: gidNumber
    member_identifier_attribute:
      type: string
      description: "Group membership identifier attribute (OpenLDAP only)"
      default: memberUid
    user_filter_class:
      type: string
      description: "User object class (OpenLDAP only)"
      default: posixAccount
    user_identifier_attribute:
      type: string
      description: "User unique identifier attribute (OpenLDAP only)"
      default: uid
    custom_attributes:
      type: string
      description: "Extra user attributes added to the user filter in ad-authenticate-and-roles, as 'attrA=valA,attrB=valB' (OpenLDAP only)"
  required:
    - ldap_server_vendor
    - host
    - username
    - password
    - base_dn
    - connection_type

commands:
  - id: test_connection
    name: ad-test-connection
    description: "Bind to the LDAP server with the configured credentials (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }

  - id: ad_authenticate
    name: ad-authenticate
    description: "Perform a simple bind on the LDAP server with the given username and password."
    risk: read
    inputs_schema:
      properties:
        username: { type: string, description: "Username for simple authentication" }
        password: { type: string, description: "Password for simple authentication", x-soar-sensitive: true }
      required: [username, password]
    outputs_schema: { properties: {} }

  - id: ad_groups
    name: ad-groups
    description: "Fetch LDAP groups under the base DN, or a specific set of groups (DNs delimited by '#')."
    risk: read
    inputs_schema:
      properties:
        specific-groups: { type: string, description: "Group object names/DNs to fetch, delimited by a number sign (#)" }
      required: []
    outputs_schema: { properties: {} }

  - id: ad_authenticate_and_roles
    name: ad-authenticate-and-roles
    description: "Simple bind on the LDAP server and return the authenticated user's groups and selected attributes."
    risk: read
    inputs_schema:
      properties:
        username: { type: string, description: "Username for simple authentication" }
        password: { type: string, description: "Password for simple authentication", x-soar-sensitive: true }
        attribute-mail: { type: string, description: "Mail attribute to return (default mail)" }
        attribute-name: { type: string, description: "Name attribute to return (default name)" }
        attribute-phone: { type: string, description: "Phone attribute to return (default mobile)" }
        attribute-name-pull: { type: string, description: "Return the name attribute (default true)" }
        attribute-mail-pull: { type: string, description: "Return the mail attribute (default true)" }
        attribute-phone-pull: { type: string, description: "Return the phone attribute (default false)" }
      required: [username, password]
    outputs_schema: { properties: {} }

  - id: ad_entries_search
    name: ad-entries-search
    description: "Generic LDAP search. Combine raw search_filter with cn/uid/object_class/description filters (joined with OR), choose scope and attributes, and page the results."
    risk: read
    inputs_schema:
      properties:
        search_base: { type: string, description: "Where the search starts (defaults to the instance base_dn)" }
        search_filter: { type: string, description: "Raw LDAP filter; joined with the other filter args using OR" }
        search_scope: { type: string, description: "BASE, LEVEL or SUBTREE (default SUBTREE)" }
        attributes: { type: string, description: "none, all_user_attributes, all_operational_attributes, all, or a CSV list (default all)" }
        cn: { type: string, description: "CSV list of CNs to filter by (joined with AND)" }
        uid: { type: string, description: "CSV list of UIDs to filter by (joined with AND)" }
        object_class: { type: string, description: "CSV list of objectClasses to filter by (joined with AND)" }
        description: { type: string, description: "CSV list of descriptions to filter by (joined with AND)" }
        page: { type: number, description: "Page number to return" }
        page_size: { type: number, description: "Entries per page (max 2000, default 50)" }
        limit: { type: number, description: "Maximum entries to return when not paging (default 50)" }
      required: []
    outputs_schema: { properties: {} }