Active Containment

InsightConnect
1

hello!
I am working to implement active containment which basically gives me insightconnect.

I have had my orchestrator setup for quite sometime and have created a connector for AD
and have setup a user I am testing with to create my connector. The issue I keep getting is this:

Result

The disable user action was skipped because the user did not exist in Active Directory/LDAP during the job’s execution.

Kind of odd because it does seem to see the user in the logs but no matter what user I use to create the connection it always tells me that the user does not exist.

I have verified that the users I am using for this have the ability to disable users.

any ideas why I keep getting this? I am new to insightconnect, thanks in advance.

2

how are you providing the DistinguishedName? I do a LDAP query for the user then provide the DistinguishedName from that result to the disable user and that works.

3

Hello @brandon_mcclure
would that be a part of the connector?

from the logs this is what I am seeing, at the bottom it appears to display the full
path to the user.

Result

The disable user action was skipped because the user did not exist in Active Directory/LDAP during the job’s execution.

DN: cn=test, User,ou=service accounts,ou=users,ou=cf,dc=ad,dc=company,dc=com
Name: User Test

4

No, that is the field for the Disable Action in the LDAP Plugin.

Troubleshooting steps:

  1. Go to the Connector and run the test, make sure that is successful first.
  2. If that passes, Create a test Workflow and add an LDAP Query Action step with these fields filled out
    a) Search Filter: (&(objectClass=person)(objectClass=user)(distinguishedName=cn=test, User,ou=service accounts,ou=users,ou=cf,dc=ad,dc=company,dc=com))
    b) Search Base: dc=company,dc=com
  3. If that finds the user then the LDAP Disable Action should work with this defined
    a) Distinguished Name: cn=test, User,ou=service accounts,ou=users,ou=cf,dc=ad,dc=company,dc=com