Zoom_IAM
An Identity and Access Management integration template.
Identity and Access Management · Zoom
Details
| ID | Zoom_IAM |
|---|---|
| Provider | Zoom |
| Category | Identity and Access Management |
| From Version | 6.0.0 |
| Docker Image | demisto/auth-utils:1.0.0.5476008 |
| Supported Modules | Agentix XSIAM EDR Cortex Cloud Cloud Runtime Security |
README
An Identity and Access Management integration template.
This integration was integrated and tested with version 2.0.0 of Zoom_IAM.
Configure Zoom_IAM in Cortex
| Parameter | Description | Required |
|---|---|---|
| Server URL (e.g., ‘https://api.zoom.us/v2/’) | False | |
| Account ID (OAuth) | False | |
| Client ID (OAuth) | False | |
| Client Secret (OAuth) | False | |
| API Key (JWT-Deprecated) | This authentication method is deprecated. | False |
| API Secret (JWT-Deprecated) | This authentication method is deprecated. | False |
| Use system proxy settings | False | |
| Trust any certificate (not secure) | False | |
| Allow disabling users | False | |
| Allow enabling users | False | |
| Incoming Mapper | False | |
| Outgoing Mapper | Cortex XSOAR only parameter. | False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
iam-disable-user
Disable an active user.
Base Command
iam-disable-user
Input
| Argument Name | Description | Required |
|---|---|---|
| user-profile | A User Profile indicator. For example: {"email": "john.doe@example.com"}. |
Required |
Context Output
| Path | Type | Description |
|---|---|---|
| IAM.Vendor.active | Boolean | When true, indicates that the employee’s status is active in the 3rd-party integration. |
| IAM.Vendor.brand | String | Name of the integration. |
| IAM.Vendor.details | string | Provides the raw data from the 3rd-party integration. |
| IAM.Vendor.email | String | The employee’s email address. |
| IAM.Vendor.errorCode | Number | HTTP error response code. |
| IAM.Vendor.errorMessage | String | Reason why the API failed. |
| IAM.Vendor.id | String | The employee’s user ID in the app. |
| IAM.Vendor.instanceName | string | Name of the integration instance. |
| IAM.Vendor.success | Boolean | When true, indicates that the command was executed successfully. |
| IAM.Vendor.username | String | The employee’s username in the app. |
Command example
!iam-disable-user user-profile=`{"email": "example@example.com", "givenname": "Example"}`
Context Example
{
"IAM": {
"UserProfile": {
"email": "example@example.com",
"givenname": "Example"
},
"Vendor": [
{
"action": "disable",
"active": false,
"brand": "Zoom_IAM",
"details": {
"email": "example@example.com",
"givenname": "Example"
},
"email": "example@example.com",
"errorCode": null,
"errorMessage": "",
"id": "6mIygOyeTT61Wzw_PAo5jw",
"instanceName": "Zoom_IAM_instance_1 JWT",
"reason": "",
"skipped": false,
"success": true,
"username": ""
},
{
"action": "disable",
"active": null,
"brand": "Zoom_IAM",
"details": {
"account_id": "aeKD2BFJRASt1QVURWo9CA",
"account_number": 1114287,
"cluster": "us06",
"cms_user_id": "",
"created_at": "2020-06-16T06:57:23Z",
"dept": "",
"email": "example@example.com",
"first_name": "Example",
"group_ids": [],
"id": "6mIygOyeTT61Wzw_PAo5jw",
"im_group_ids": [],
"jid": "6miygoyett61wzw_pao5jw@xmpp.zoom.us",
"job_title": "",
"language": "en-US",
"last_client_version": "5.8.7.2058(win)",
"last_login_time": "2022-08-24T07:25:49Z",
"last_name": "Example",
"location": "",
"login_types": [
1
],
"personal_meeting_url": "https://us06web.zoom.us/j/3269259758?pwd=Q2VTN1JsM2J2OCtmS1hWaHBTUmV6QT09",
"phone_country": "",
"phone_number": "",
"pic_url": "https://lh3.googleusercontent.com/a/AItbvmn0GJLCTIkOIatpkUy-PuEf-tFQEnBVOUxcT2oB=s96-c",
"pmi": 3269259758,
"role_id": "2",
"role_name": "Member",
"status": "inactive",
"timezone": "Asia/Jerusalem",
"type": 1,
"use_pmi": false,
"user_created_at": "2020-06-16T06:57:23Z",
"verified": 0
},
"email": "example@example.com",
"errorCode": null,
"errorMessage": "",
"id": null,
"instanceName": "Zoom_IAM_instance_2 OAuth",
"reason": "User is already disabled.",
"skipped": true,
"success": true,
"username": null
}
]
}
}
Human Readable Output
Disable User Results (Zoom_IAM)
brand instanceName success active id details Zoom_IAM Zoom_IAM_instance_1 JWT true false 6mIygOyeTT61Wzw_PAo5jw example@example.com email: example@example.com
givenname: Example
iam-enable-user
Enable a deactivated user.
Base Command
iam-enable-user
Input
| Argument Name | Description | Required |
|---|---|---|
| user-profile | A User Profile indicator. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| IAM.Vendor.active | Boolean | When true, indicates that the employee’s status is active in the 3rd-party integration. |
| IAM.Vendor.brand | String | Name of the integration. |
| IAM.Vendor.details | string | Provides the raw data from the 3rd-party integration. |
| IAM.Vendor.email | String | The employee’s email address. |
| IAM.Vendor.errorCode | Number | HTTP error response code. |
| IAM.Vendor.errorMessage | String | Reason why the API failed. |
| IAM.Vendor.id | String | The employee’s user ID in the app. |
| IAM.Vendor.instanceName | string | Name of the integration instance. |
| IAM.Vendor.success | Boolean | When true, indicates that the command was executed successfully. |
| IAM.Vendor.username | String | The employee’s username in the app. |
Command example
!iam-enable-user user-profile=`{"email": "example@example.com", "givenname": "Example"}`
Context Example
{
"IAM": {
"UserProfile": {
"email": "example@example.com",
"givenname": "Example"
},
"Vendor": [
{
"action": "enable",
"active": true,
"brand": "Zoom_IAM",
"details": {
"email": "example@example.com",
"givenname": "Example"
},
"email": "example@example.com",
"errorCode": null,
"errorMessage": "",
"id": "6mIygOyeTT61Wzw_PAo5jw",
"instanceName": "Zoom_IAM_instance_2 OAuth",
"reason": "",
"skipped": false,
"success": true,
"username": ""
},
{
"action": "enable",
"active": true,
"brand": "Zoom_IAM",
"details": {
"email": "example@example.com",
"givenname": "Example"
},
"email": "example@example.com",
"errorCode": null,
"errorMessage": "",
"id": "6mIygOyeTT61Wzw_PAo5jw",
"instanceName": "Zoom_IAM_instance_1 JWT",
"reason": "",
"skipped": false,
"success": true,
"username": ""
}
]
}
}
Human Readable Output
Enable User Results (Zoom_IAM)
brand instanceName success active id details Zoom_IAM Zoom_IAM_instance_2 OAuth true true 6mIygOyeTT61Wzw_PAo5jw example@example.com email: example@example.com
givenname: Example
iam-get-user
Retrieves a single user resource.
Base Command
iam-get-user
Input
| Argument Name | Description | Required |
|---|---|---|
| user-profile | A User Profile indicator. | Required |
Context Output
There is no context output for this command.
Command example
!iam-get-user user-profile=`{"email": "example@example.com", "givenname": "Example"}`
Context Example
{
"IAM": {
"UserProfile": {
"account_id": "aeKD2BFJRASt1QVURWo9CA",
"account_number": 1114287,
"cluster": "us06",
"cms_user_id": "",
"created_at": "2020-06-16T06:57:23Z",
"dept": "",
"email": "example@example.com",
"first_name": "Example",
"group_ids": [],
"id": "6mIygOyeTT61Wzw_PAo5jw",
"im_group_ids": [],
"jid": "6miygoyett61wzw_pao5jw@xmpp.zoom.us",
"job_title": "",
"language": "en-US",
"last_client_version": "5.8.7.2058(win)",
"last_login_time": "2022-08-24T07:25:49Z",
"last_name": "Example",
"location": "",
"login_types": [
1
],
"personal_meeting_url": "https://us06web.zoom.us/j/3269259758?pwd=Q2VTN1JsM2J2OCtmS1hWaHBTUmV6QT09",
"phone_country": "",
"phone_number": "",
"pic_url": "https://lh3.googleusercontent.com/a/AItbvmn0GJLCTIkOIatpkUy-PuEf-tFQEnBVOUxcT2oB=s96-c",
"pmi": 3269259758,
"role_id": "2",
"role_name": "Member",
"status": "active",
"timezone": "Asia/Jerusalem",
"type": 1,
"use_pmi": false,
"user_created_at": "2020-06-16T06:57:23Z",
"verified": 0
},
"Vendor": [
{
"action": "get",
"active": true,
"brand": "Zoom_IAM",
"details": {
"account_id": "aeKD2BFJRASt1QVURWo9CA",
"account_number": 1114287,
"cluster": "us06",
"cms_user_id": "",
"created_at": "2020-06-16T06:57:23Z",
"dept": "",
"email": "example@example.com",
"first_name": "Example",
"group_ids": [],
"id": "6mIygOyeTT61Wzw_PAo5jw",
"im_group_ids": [],
"jid": "6miygoyett61wzw_pao5jw@xmpp.zoom.us",
"job_title": "",
"language": "en-US",
"last_client_version": "5.8.7.2058(win)",
"last_login_time": "2022-08-24T07:25:49Z",
"last_name": "Example",
"location": "",
"login_types": [
1
],
"personal_meeting_url": "https://us06web.zoom.us/j/3269259758?pwd=Q2VTN1JsM2J2OCtmS1hWaHBTUmV6QT09",
"phone_country": "",
"phone_number": "",
"pic_url": "https://lh3.googleusercontent.com/a/AItbvmn0GJLCTIkOIatpkUy-PuEf-tFQEnBVOUxcT2oB=s96-c",
"pmi": 3269259758,
"role_id": "2",
"role_name": "Member",
"status": "active",
"timezone": "Asia/Jerusalem",
"type": 1,
"use_pmi": false,
"user_created_at": "2020-06-16T06:57:23Z",
"verified": 0
},
"email": "example@example.com",
"errorCode": null,
"errorMessage": "",
"id": "6mIygOyeTT61Wzw_PAo5jw",
"instanceName": "Zoom_IAM_instance_2 OAuth",
"reason": "",
"skipped": false,
"success": true,
"username": ""
},
{
"action": "get",
"active": true,
"brand": "Zoom_IAM",
"details": {
"account_id": "aeKD2BFJRASt1QVURWo9CA",
"account_number": 1114287,
"cluster": "us06",
"cms_user_id": "",
"created_at": "2020-06-16T06:57:23Z",
"dept": "",
"email": "example@example.com",
"first_name": "Example",
"group_ids": [],
"id": "6mIygOyeTT61Wzw_PAo5jw",
"im_group_ids": [],
"jid": "6miygoyett61wzw_pao5jw@xmpp.zoom.us",
"job_title": "",
"language": "en-US",
"last_client_version": "5.8.7.2058(win)",
"last_login_time": "2022-08-24T07:25:49Z",
"last_name": "Example",
"location": "",
"login_types": [
1
],
"personal_meeting_url": "https://us06web.zoom.us/j/3269259758?pwd=Q2VTN1JsM2J2OCtmS1hWaHBTUmV6QT09",
"phone_country": "",
"phone_number": "",
"pic_url": "https://lh3.googleusercontent.com/a/AItbvmn0GJLCTIkOIatpkUy-PuEf-tFQEnBVOUxcT2oB=s96-c",
"pmi": 3269259758,
"role_id": "2",
"role_name": "Member",
"status": "active",
"timezone": "Asia/Jerusalem",
"type": 1,
"use_pmi": false,
"user_created_at": "2020-06-16T06:57:23Z",
"verified": 0
},
"email": "example@example.com",
"errorCode": null,
"errorMessage": "",
"id": "6mIygOyeTT61Wzw_PAo5jw",
"instanceName": "Zoom_IAM_instance_1 JWT",
"reason": "",
"skipped": false,
"success": true,
"username": ""
}
]
}
}
Human Readable Output
Get User Results (Zoom_IAM)
brand instanceName success active id details Zoom_IAM Zoom_IAM_instance_1 JWT true true 6mIygOyeTT61Wzw_PAo5jw example@example.com id: 6mIygOyeTT61Wzw_PAo5jw
first_name: Example
last_name: Example
email: example@example.com
type: 1
role_name: Member
pmi: 3269259758
use_pmi: false
personal_meeting_url: https://us06web.zoom.us/j/3269259758?pwd=Q2VTN1JsM2J2OCtmS1hWaHBTUmV6QT09
timezone: Asia/Jerusalem
verified: 0
dept:
created_at: 2020-06-16T06:57:23Z
last_login_time: 2022-08-24T07:25:49Z
last_client_version: 5.8.7.2058(win)
pic_url: https://lh3.googleusercontent.com/a/AItbvmn0GJLCTIkOIatpkUy-PuEf-tFQEnBVOUxcT2oB=s96-c
cms_user_id:
jid: 6miygoyett61wzw_pao5jw@xmpp.zoom.us
group_ids:
im_group_ids:
account_id: aeKD2BFJRASt1QVURWo9CA
language: en-US
phone_country:
phone_number:
status: active
job_title:
location:
login_types: 1
role_id: 2
account_number: 1114287
cluster: us06
user_created_at: 2020-06-16T06:57:23Z
get-mapping-fields
Retrieves a User Profile schema, which holds all of the user fields within the application. Used for outgoing-mapping through the Get Schema option.
Base Command
get-mapping-fields
Input
There are no input arguments for this command.
Context Output
There is no context output for this command.
Incident Mirroring
You can enable incident mirroring between Cortex XSOAR incidents and Zoom_IAM corresponding events (available from Cortex XSOAR version 6.0.0).
To set up the mirroring:
Enable Fetching incidents in your instance configuration.
Newly fetched incidents will be mirrored in the chosen direction. However, this selection does not affect existing incidents.
Important Note: To ensure the mirroring works as expected, mappers are required, both for incoming and outgoing, to map the expected fields in Cortex XSOAR and Zoom_IAM.
Configuration parameters
url— Server URL (e.g., 'https://api.zoom.us/v2/')account_id— Account ID (OAuth)credentials— Client ID (OAuth)creds_api_key—creds_api_secret—api_key— API Key (JWT-Deprecated)api_secret— API Secret (JWT-Deprecated)proxy— Use system proxy settingsinsecure— Trust any certificate (not secure)disable-user-enabled— Allow disabling usersenable-user-enabled— Allow enabling usersmapper_in— Incoming Mappermapper_out— Outgoing Mapper
Commands (4)
-
get-mapping-fieldsRetrieves a User Profile schema, which holds all of the user fields within the application. Used for outgoing-mapping through the Get Schema option.
-
iam-disable-userDisable an active user.
-
iam-enable-userEnable a deactivated user.
-
iam-get-userRetrieves a single user resource.
import pytest import Zoom_IAM from IAMApiModule import * from Zoom_IAM import Client APP_USER_OUTPUT = { "user_id": "mock_id", "user_name": "mock_user_name", "first_name": "mock_first_name", "last_name": "mock_last_name", "email": "testdemisto2@paloaltonetworks.com", } USER_APP_DATA = IAMUserAppData("mock_id", "mock_user_name", is_active=True, app_data=APP_USER_OUTPUT) USER_APP_DATA_DISABLED = IAMUserAppData("mock_id", "mock_user_name", is_active=False, app_data=APP_USER_OUTPUT) APP_DISABLED_USER_OUTPUT = { "user_id": "mock_id", "user_name": "mock_user_name", "first_name": "mock_first_name", "last_name": "mock_last_name", "active": "false", "email": "testdemisto2@paloaltonetworks.com", } APP_ENABLED_USER_OUTPUT = { "user_id": "mock_id", "user_name": "mock_user_name", "first_name": "mock_first_name", "last_name": "mock_last_name", "active": "true", "email": "testdemisto2@paloaltonetworks.com", } DISABLED_USER_APP_DATA = IAMUserAppData("mock_id", "mock_user_name", is_active=False, app_data=APP_DISABLED_USER_OUTPUT) ENABLED_USER_APP_DATA = IAMUserAppData("mock_id", "mock_user_name", is_active=True, app_data=APP_ENABLED_USER_OUTPUT) def mock_client_ouath(mocker): mocker.patch.object(Client, "get_oauth_token") client = Client(base_url="https://test.com", account_id="mockaccount", client_id="mockclient", client_secret="mocksecret") return client def get_outputs_from_user_profile(user_profile): entry_context = user_profile.to_entry() outputs = entry_context.get("Contents") return outputs def test_disable_user_command__allow_disable(mocker): """ Given: - An app client object - A user-profile argument that contains user data When: - The user is enabled in the application - allow-disable argument is true - Calling function disable_user_command Then: - Ensure the user is disabled at the end of the command execution. """ client = mock_client_ouath(mocker) args = { "user-profile": {"email": "testdemisto2@paloaltonetworks.com", "givenname": "mock_first_name"}, "allow-disable": "true", } mocker.patch.object(client, "get_user", return_value=USER_APP_DATA) mocker.patch.object(client, "disable_user", return_value=DISABLED_USER_APP_DATA) user_profile = IAMCommand().disable_user(client, args) outputs = get_outputs_from_user_profile(user_profile) assert outputs.get("action") == IAMActions.DISABLE_USER assert outputs.get("success") is True assert outputs.get("active") is False assert outputs.get("id") == "mock_id" assert outputs.get("username") == "mock_user_name" assert outputs.get("details", {}).get("first_name") == "mock_first_name" assert outputs.get("details", {}).get("last_name") == "mock_last_name" def test_disable_user_command__non_existing_user(mocker): """ Given: - An app client object - A user-profile argument that contains an email of a user When: - The user does not exist in the application - Calling function disable_user_command Then: - Ensure the command is considered successful and skipped """ client = mock_client_ouath(mocker) args = {"user-profile": {"email": "testdemisto2@paloaltonetworks.com"}} mocker.patch.object(client, "get_user", return_value=None) user_profile = IAMCommand().disable_user(client, args) outputs = get_outputs_from_user_profile(user_profile) assert outputs.get("action") == IAMActions.DISABLE_USER assert outputs.get("success") is True assert outputs.get("skipped") is True assert outputs.get("reason") == IAMErrors.USER_DOES_NOT_EXIST[1] def test_enable_user_command__allow_enable(mocker): """ Given: - An app client object - A user-profile argument that contains user data When: - The user is disabled in the application - allow-enable argument is true - Calling function enable_user_command Then: - Ensure the user is enabled at the end of the command execution. """ client = mock_client_ouath(mocker) args = { "user-profile": {"email": "testdemisto2@paloaltonetworks.com", "givenname": "mock_first_name"}, "allow-enable": "true", } mocker.patch.object(client, "get_user", return_value=USER_APP_DATA_DISABLED) mocker.patch.object(client, "enable_user", return_value=ENABLED_USER_APP_DATA) user_profile = IAMCommand().enable_user(client, args) outputs = get_outputs_from_user_profile(user_profile) assert outputs.get("action") == IAMActions.ENABLE_USER assert outputs.get("success") is True assert outputs.get("active") is True assert outputs.get("id") == "mock_id" assert outputs.get("username") == "mock_user_name" assert outputs.get("details", {}).get("first_name") == "mock_first_name" assert outputs.get("details", {}).get("last_name") == "mock_last_name" def test_enable_user_command__non_existing_user(mocker): """ Given: - An app client object - A user-profile argument that contains an email of a user When: - The user does not exist in the application - Calling function enable_user_command Then: - Ensure the command is considered successful and skipped """ client = mock_client_ouath(mocker) args = {"user-profile": {"email": "testdemisto2@paloaltonetworks.com"}} mocker.patch.object(client, "get_user", return_value=None) user_profile = IAMCommand().enable_user(client, args) outputs = get_outputs_from_user_profile(user_profile) assert outputs.get("action") == IAMActions.ENABLE_USER assert outputs.get("success") is True assert outputs.get("skipped") is True assert outputs.get("reason") == IAMErrors.USER_DOES_NOT_EXIST[1] def test_check_authentication_type_arguments__with_extra_jwt_member(mocker): """ Given - client When - creating a client with an extra authentication type argument Then - Validate that the error wil raise as excepted """ with pytest.raises(DemistoException) as e: Zoom_IAM.check_authentication_type_arguments( account_id="mockaccount", client_id="mockclient", client_secret="mocksecret", api_key="blabla", api_secret="" ) assert ( e.value.message == """Too many fields were filled. You should fill the Account ID, Client ID, and Client Secret fields (OAuth), OR the API Key and API Secret fields (JWT - Deprecated)""" ) def test_check_authentication_type_arguments__with_extra_AOuth_member(mocker): """ Given - client When - creating a client with an extra authentication type argument Then - Validate that the error wil raise as excepted """ with pytest.raises(DemistoException) as e: Zoom_IAM.check_authentication_type_arguments( account_id="", client_id="", client_secret="mocksecret", api_key="blabla", api_secret="ertert" ) assert ( e.value.message == """Too many fields were filled. You should fill the Account ID, Client ID, and Client Secret fields (OAuth), OR the API Key and API Secret fields (JWT - Deprecated)""" ) def test_test_moudle__reciving_errors(mocker): mocker.patch.object(Client, "generate_oauth_token") client = Client(base_url="https://test.com", account_id="mockaccount", client_id="mockclient", client_secret="mocksecret") mocker.patch.object(Client, "test", side_effect=DemistoException("Invalid access token")) from Zoom_IAM import test_module assert test_module(client=client) == "Invalid credentials. Please verify that your credentials are valid." def test_test_moudle__reciving_errors_1(mocker): mocker.patch.object(Client, "generate_oauth_token") client = Client(base_url="https://test.com", account_id="mockaccount", client_id="mockclient", client_secret="mocksecret") mocker.patch.object(Client, "test", side_effect=DemistoException("The Token's Signature resulted invalid")) from Zoom_IAM import test_module assert test_module(client=client) == "Invalid API Secret. Please verify that your API Secret is valid." def test_test_moudle__reciving_errors_2(mocker): mocker.patch.object(Client, "generate_oauth_token") client = Client(base_url="https://test.com", account_id="mockaccount", client_id="mockclient", client_secret="mocksecret") mocker.patch.object(Client, "test", side_effect=DemistoException("Invalid client_id or client_secret")) from Zoom_IAM import test_module assert test_module(client=client) == "Invalid Client ID or Client Secret. Please verify that your ID and Secret is valid." def test_test_moudle__reciving_errors_3(mocker): mocker.patch.object(Client, "generate_oauth_token") client = Client(base_url="https://test.com", account_id="mockaccount", client_id="mockclient", client_secret="mocksecret") mocker.patch.object(Client, "test", side_effect=DemistoException("mockerror")) from Zoom_IAM import test_module assert test_module(client=client) == "Problem reaching Zoom API, check your credentials. Error message: mockerror" def test_get_error_details(): """ Given: - An error response from the API When: - Calling function get_error_details Then: - Ensure the error details are returned as expected """ from Zoom_IAM import get_error_details assert get_error_details({"code": "mock", "message": "mockerror"}) == "mock: mockerror" @pytest.mark.parametrize("returned, expected", [(None, "NoneType"), ({"users": None}, "IAMUserAppData")]) def test_get_user(mocker, returned, expected): """ Given: - An app client object - A user-profile argument that contains an email of a user When: - Calling function get_user 1. results is None 2. results is a dict with 'users' key is None Then: - Ensure the user profile is returned as expected """ client = mock_client_ouath(mocker) args = {"user-profile": {"email": "blabla"}} mocker.patch.object(client, "error_handled_http_request", return_value=returned) res = client.get_user(client, args) assert expected == type(res).__name__ def test_test_moudle(mocker): """ Given: - An app client object When: - Calling function test_module Then: - Ensure the test module is returned as expected """ client = mock_client_ouath(mocker) mocker.patch.object(Client, "get_user") from Zoom_IAM import test_module res = test_module(client) assert res == "ok"