Splunk SOAR ldap config files?

[esgrav]

Hi,

Anyone knows where ldap config files are stored for Splunk SOAR?

Doc only gives me the clickops way...

There is no directory where you can find this for other splunk compontents; $SPLUNK_HOME/etc/system/local/

So are they stored in DB or what?

[phanTom · Accepted solution]

@esgrav I take it you are looking at a programmatic way to create/update the LDAP configuration?

I don't believe you can in the same way you can with Splunk and just inject a .conf file for LDAP. I have also checked the REST docs and there is no REST endpoint to configure this, hence I would make an educated guess that it can't be done any other way than the UI. 

In ES8.x paired with SOAR 7.x then I think the LDAP scheme in Splunk can be used to manage access to SOAR as they are closer paired and AFAIK share the same authentication schema. 

--  Please provide Karma if it helped, and mark it a solution if it resolved your query. Happy SOARing! --

[esgrav]

Ok, thanks for confirming my suspicion...