topic Phantom integration with Microsoft LDAP in Splunk SOAR

Phantom integration with Microsoft LDAP

waleksandrowski — Sun, 07 Jun 2020 16:32:18 GMT

I have a problem with integration of Phantom with Active Directory. When I try to test connectivity with "Microsoft LDAP" app there is error with message:

App 'LDAP' started successfully (id: 1580900681102) on asset: 'pcb.lab'(id: 10)
Loaded action execution configuration
Ldap module initialized
1 action failed handle_action exception occurred. Error string: 'cannot concatenate 'str' and 'dict' objects'

Re: Phantom integration with Microsoft LDAP

barisaydogmusog — Sun, 15 Mar 2020 19:13:48 GMT

Hi,
I have come up with the same issue, any update?
Regards

Re: Phantom integration with Microsoft LDAP

waleksandrowski — Tue, 17 Mar 2020 09:47:18 GMT

Hi,

there is no update but this integration works with Phantom version 4.6.18265. After update to version 4.8.23319 this error occurs. Probably this is problem with python version (python 3.6 in Phantom 4.8) but not sure.

Regards

Re: Phantom integration with Microsoft LDAP

TWiseOne — Fri, 03 Apr 2020 15:43:27 GMT

I can confirm that there is an Open, Critical JIRA ticket for this with Phantom engineering. Myself and a Customer have recently raised tickets with the exact same issue and were advised of the JIRA status.

Re: Phantom integration with Microsoft LDAP

satishclarios — Wed, 13 May 2020 19:22:54 GMT

@TWiseOne Any updates on this I'm getting the same error when I try to connect to LDAP.

Re: Phantom integration with Microsoft LDAP

TWiseOne — Thu, 14 May 2020 08:14:53 GMT

@satishclarios If you are able to raise a support case I believe they have a patched version not quite GA yet. My customer was provided version 1.2.44 which resolved my issue. If you are not using this version on 4.8 I would recommend asking support.

Re: Phantom integration with Microsoft LDAP

ericbrown1991 — Wed, 20 May 2020 00:30:06 GMT

Any update here?

Re: Phantom integration with Microsoft LDAP

ericbrown1991 — Wed, 20 May 2020 00:30:28 GMT

Any update?

Re: Phantom integration with Microsoft LDAP

satishclarios — Tue, 26 May 2020 12:49:58 GMT

Yes, they recommended to use the latest version of the app.

Re: Phantom integration with Microsoft LDAP

rneto — Mon, 20 Jul 2020 18:49:48 GMT

I had the same issue, but after upgrade the LDAP app version to 1.2.44, the connection worked fine.

Re: Phantom integration with Microsoft LDAP

sam_splunk — Fri, 18 Sep 2020 18:59:52 GMT

Please see if the following is helpful:

https://community.splunk.com/t5/Security/How-to-configure-Phantom-to-use-LDAP-Active-Directory-for/m-p/471157#M10922