Description
If you want to do LDAP integration on Logsign, and want to login logsign gui via Ldap users please follow below steps ;
Resolution
- Go Settings > Responses > LDAP > Configure > + Device
- Enter required fields then click Test button.
- If everything is correct, click Create button.
- Now you can sync your LDAP identities with these steps; Settings > Enrichment > Identities > Sync Ldap
- Select LDAP server and click Sync button.
Sync Interval: By default, LDAP identity sync also runs automatically once a day at 02:00. If you want a shorter cadence, open the source and set the Sync Interval field to 1, 2, 4, 6, or 12 hours. Leaving it unset (or set to 24) keeps the once-daily 02:00 sync. Manual sync (the steps above) always works regardless of this setting, and one source failing to sync does not block the others from syncing.
- Now you can see all created users from AD
- If you want login on Logsign with any AD users, you can add this user on Logsign with these steps; Select User > Click Apply Role Selected > Select User Role or Select Admin Role > Click Save button.
- Now you can see LDAP user on Settings > Account and Views > Users and you can login with LDAP user on Logsign.
Available Response/Action Methods
Once configured, this LDAP device can also be used as a Response integration (Settings > Integrations > Responses > LDAP), for example from an Action Rule or manually from an incident. Based on a source-code review, the following methods are available:
- list-users / search-users: list or search directory users.
- disable / enable: disable or re-enable a user account. This is the method used in account-compromise response scenarios (see "Taking Action to an Incident").
- unlock-user: clears a locked-out account (resets the account's lockout state) without changing its password.
- reset-password: forces a password reset for a user.
- add-user-to-group / remove-user-from-group: manage group membership.
Exact field names and required permissions for each method have not been independently re-verified against a live directory; confirm by testing in a non-production environment first.