IBM Support

LDAP and Active Directory Functions for QRadar SOAR - "invalid server address"

Troubleshooting


Problem

A client was not able to use the LDAP and Active Directory Functions application to retrieve data from Active Directory. An error was returned when the function ran and no data was returned to the incident or case.

Symptom

The client found an error in the Action status of the incident or case, "invalid server address."
Action status

Cause

The app.config for the application was not configured correctly and was missing a space.

Environment

The problem was seen by using App Host but the problem could also occur on an integration server running Resilient Circuits.

Diagnosing The Problem

The logs return "invalid server address" when a workflow containing the LDAP function was invoked.
2022-11-22 08:23:32,085 ERROR [actions_component] Traceback (most recent call last):
File "/opt/app-root/lib/python3.6/site-packages/resilient_circuits/actions_component.py", line 80, in _on_task
yield result.get()
File "/usr/lib64/python3.6/multiprocessing/pool.py", line 644, in get
raise self._value
File "/usr/lib64/python3.6/multiprocessing/pool.py", line 119, in worker
result = (True, func(*args, **kwds))
File "/opt/app-root/lib/python3.6/site-packages/resilient_circuits/decorators.py", line 100, in _call_the_task
raise val
resilient_circuits.action_message.FunctionException_: 
Traceback (most recent call last):
File "/opt/app-root/lib/python3.6/site-packages/fn_ldap_utilities/components/ldap_utilities_search.py", line 112, in _ldap_utilities_search_function
conn.bind()
File "/opt/app-root/lib/python3.6/site-packages/ldap3/core/connection.py", line 589, in bind
self.open(read_server_info=False)
File "/opt/app-root/lib/python3.6/site-packages/ldap3/strategy/sync.py", line 57, in open
BaseStrategy.open(self, reset_usage, read_server_info)
File "/opt/app-root/lib/python3.6/site-packages/ldap3/strategy/base.py", line 154, in open
raise LDAPSocketOpenError('invalid server address')
ldap3.core.exceptions.LDAPSocketOpenError: invalid server address
The app.config did not have a space after ldap_server and =.
[fn_ldap_utilities]
ldap_server= ldap.domain.com

Resolving The Problem

The app.config was changed to add a space. Once the change was saved and the app restarted the LDAP function worked as expected.
[fn_ldap_utilities]
ldap_server = ldap.domain.com

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSA230","label":"IBM Security QRadar SOAR"},"ARM Category":[{"code":"a8m0z000000cvqKAAQ","label":"Integrations"}],"ARM Case Number":"TS011314888","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"},{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSEGM63","label":"IBM Security QRadar SOAR on Cloud"},"ARM Category":[{"code":"a8m0z000000cvqKAAQ","label":"Integrations"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"},{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSTDPP","label":"IBM Cloud Pak for Security"},"ARM Category":[{"code":"a8m0z0000001h8pAAA","label":"Cases"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
22 November 2022

UID

ibm16841031