SAP-IAM

Details

ID	`SAP-IAM`
Provider	SAP
Category	Identity and Access Management
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

Integrate with SAP’s services to execute get and disable operations for employee lifecycle processes.

Configure SAP - IAM in Cortex

Parameter	Description	Required
Base URL		True
Deactive User URL		False
Username		True
Password		True
Allow disabling users	Determines whether users can be disabled using the SAP IAM integration	False
Incoming Mapper		True
Outgoing Mapper	Cortex XSOAR only parameter.	False
Trust any certificate (not secure)	Trust any certificate (not secure).	False
Use system proxy settings	Use system proxy settings.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

iam-get-user

Retrieves a single user resource.

Base Command

iam-get-user

Input

Argument Name	Description	Required
user-profile	A User Profile indicator.	Required

Context Output

Path	Type	Description
IAM.Vendor.active	Boolean	When true, indicates that the employee’s status is active in the third party integration.
IAM.Vendor.brand	String	Name of the integration.
IAM.Vendor.details	String	Provides the raw data from the third party integration.
IAM.Vendor.email	String	The employee’s email address.
IAM.Vendor.errorCode	Number	HTTP error response code.
IAM.Vendor.errorMessage	String	Reason why the API failed.
IAM.Vendor.id	String	The employee’s user ID in the app.
IAM.Vendor.instanceName	String	Name of the integration instance.
IAM.Vendor.success	Boolean	When true, indicates that the command was executed successfully.
IAM.Vendor.username	String	The employee’s username in the app.

Command Example

!iam-get-user user-profile={"username": "john.doe@example.com"}

Human Readable Output

iam-disable-user

Disable an active user.

Base Command

iam-disable-user

Input

Argument Name	Description	Required
user-profile	A User Profile indicator.	Required

Context Output

Path	Type	Description
IAM.Vendor.active	Boolean	When true, indicates that the employee’s status is active in the third party integration.
IAM.Vendor.brand	String	Name of the integration.
IAM.Vendor.details	string	Provides the raw data from the third party integration.
IAM.Vendor.email	String	The employee’s email address.
IAM.Vendor.errorCode	Number	HTTP error response code.
IAM.Vendor.errorMessage	String	Reason why the API failed.
IAM.Vendor.id	String	The employee’s user ID in the app.
IAM.Vendor.instanceName	string	Name of the integration instance.
IAM.Vendor.success	Boolean	When true, indicates that the command was executed successfully.
IAM.Vendor.username	String	The employee’s username in the app.

Command Example

!iam-disable-user user-profile={"username": "john.doe@example.com"}

Configuration parameters

url — Base URL (required)
deactivate_uri — Deactive User URL
credentials — Username (required)
disable_user_enabled — Allow disabling users
mapper_in — Incoming Mapper (required)
mapper_out — Outgoing Mapper
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (3)

get-mapping-fields
Retrieves a User Profile schema, which holds all of the user fields within the application. Used for outgoing-mapping through the Get Schema option.
iam-disable-user
Disable an active user.
iam-get-user
Retrieves a single user resource.

Source

SAPIAM.py SAPIAM_test.py SAPIAM.yml SAPIAM_description.md command_examples.txt

Download History Raw

import demistomock as demisto
import requests_mock
from IAMApiModule import *
from SAPIAM import Client, get_mapping_fields, main

MOCK_ARGS = {
    "user-profile": {
        "email": "testdemisto@paloaltonetworks.com",
        "username": "test_demisto",
        "id": "1234",
    }
}

MOCK_PARAMS = {
    "url": "https://test.com",
    "deactivate_uri": "deactivate_uri",
    "credentials": {"identifier": "1234", "password": "5678"},
    "disable_user_enabled": True,
}

APP_DISABLE_USER_OUTPUT = {
    "MT_Account_Terminate_Response": {
        "user_id": "1234",
        "user_name": "test_demisto",
        "first_name": "mock_first_name",
        "last_name": "mock_last_name",
        "IsActive": False,
        "email": "testdemisto@paloaltonetworks.com",
    }
}


def mock_client():
    client = Client(base_url="https://test.com", headers={})
    return client


class TestGetUserCommand:
    def test_existing_user(self, mocker):
        """
        Given:
            - An app client object
            - A user-profile argument that contains an email of a user
        When:
            - The user exists in the application
            - Calling function get_user_command
        Then:
            - Ensure the resulted User Profile object holds the correct user details
        """
        mocker.patch.object(demisto, "command", return_value="iam-get-user")
        mocker.patch.object(demisto, "params", return_value=MOCK_PARAMS)
        mocker.patch.object(demisto, "args", return_value=MOCK_ARGS)
        mocker.patch("SAPIAM.Client.test", return_value=None)
        demisto_results_mock = mocker.patch("demistomock.results")

        main()

        assert demisto_results_mock.call_args[0][0]["Contents"]["action"] == IAMActions.GET_USER
        assert demisto_results_mock.call_args[0][0]["Contents"]["success"] is True
        assert demisto_results_mock.call_args[0][0]["Contents"]["active"] is True
        assert demisto_results_mock.call_args[0][0]["Contents"]["id"] == "1234"
        assert demisto_results_mock.call_args[0][0]["Contents"]["username"] == "test_demisto"


class TestDisableUserCommand:
    def test_success(self, mocker):
        """
        Given:
            - An app client object
            - A user-profile argument that contains an email of a user
        When:
            - create-if-not-exists parameter is unchecked
            - The user does not exist in the application
            - Calling function disable_user_command
        Then:
            - Ensure the command is considered successful and skipped
        """
        mocker.patch.object(demisto, "command", return_value="iam-disable-user")
        mocker.patch.object(demisto, "params", return_value=MOCK_PARAMS)
        mocker.patch.object(demisto, "args", return_value=MOCK_ARGS)
        mocker.patch("SAPIAM.Client.test", return_value=None)
        demisto_results_mock = mocker.patch.object(demisto, "results")

        with requests_mock.Mocker() as m:
            m.post("/deactivate_uri", json=APP_DISABLE_USER_OUTPUT)

            main()

        assert demisto_results_mock.call_args[0][0]["Contents"]["action"] == IAMActions.DISABLE_USER
        assert demisto_results_mock.call_args[0][0]["Contents"]["success"] is True
        assert demisto_results_mock.call_args[0][0]["Contents"]["active"] is False
        assert demisto_results_mock.call_args[0][0]["Contents"]["id"] == "1234"
        assert demisto_results_mock.call_args[0][0]["Contents"]["username"] == "test_demisto"


def test_get_mapping_fields_command(mocker):
    """
    Given:
        - An app client object
    When:
        - User schema in the application contains the fields 'field1' and 'field2'
        - Calling function get_mapping_fields_command
    Then:
        - Ensure a GetMappingFieldsResponse object that contains the application fields is returned
    """
    client = mock_client()
    mocker.patch.object(client, "get_app_fields", return_value={"field1": "desc1", "field2": "desc2"})

    mapping_response = get_mapping_fields(client)
    mapping = mapping_response.extract_mapping()

    assert mapping.get(IAMUserProfile.DEFAULT_INCIDENT_TYPE, {}).get("field1") == "desc1"
    assert mapping.get(IAMUserProfile.DEFAULT_INCIDENT_TYPE, {}).get("field2") == "desc2"