Description
If you want to do LDAP integration on Logsign, and want to login logsign gui via Ldap users please follow below steps ;
Resolution
- Go Settings > Responses > LDAP > Configure > + Device
- Enter required fields then click Test button.
- If everything is correct, click Create button.
- Now you can sync your LDAP identities with these steps; Settings > Enrichment > Identities > Sync Ldap
- Select LDAP server and click Sync button.
- Now you can see all created users from AD
- If you want login on Logsign with any AD users, you can add this user on Logsign with these steps; Select User > Click Apply Role Selected > Select User Role or Select Admin Role > Click Save button.
- Now you can see LDAP user on Settings > Account and Views > Users and you can login with LDAP user on Logsign.
Available Response/Action Methods
Once configured, this LDAP device can also be used as a Response integration (Settings > Integrations > Responses > LDAP), for example from an Action Rule or manually from an incident. Based on a source-code review, the following methods are available:
- list-users / search-users: list or search directory users.
- disable / enable: disable or re-enable a user account. This is the method used in account-compromise response scenarios (see "Taking Action to an Incident").
- unlock-user: clears a locked-out account (resets the account's lockout state) without changing its password.
- reset-password: forces a password reset for a user.
- add-user-to-group / remove-user-from-group: manage group membership.
These are documented here because they were not previously listed anywhere; exact field names and required permissions for each method have not been independently re-verified against a live directory for this note and should be confirmed by testing in a non-production environment first.