<div dir="ltr">Your listing of the filter seems incorrect unless that is a copy paste problem. You probably want cn=users,cn=accounts, $Suffix. The filter listed above shows user,cn=accounts,$Suffix. I am not familiar with Qradar but does it need just the uid of the user or does it need the full DN of the user?</div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><br></div><div dir="ltr"><div dir="ltr" style="font-size:12.8px"><br></div><div dir="ltr"><b style="font-size:12.8px"><font size="2">Mike Plemmons | Senior DevOps Engineer | CROSSCHX<br></font></b><div>614.427.2411</div><div><a href="mailto:mike.plemmons@crosschx.com" style="font-size:12.8px" target="_blank">mike.plemmons@crosschx.com</a><br></div><div style="font-size:12.8px"><a href="http://www.crosschx.com/" target="_blank">www.crosschx.com</a></div></div></div></div></div></div></div></div></div></div></div></div></div> <br><div class="gmail_quote">On Mon, May 8, 2017 at 4:47 PM, Sean Hogan <span dir="ltr"><<a href="mailto:schogan@us.ibm.com" target="_blank">schogan@us.ibm.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><p><font size="2">Thanks Michael,</font><br><br><font size="2">Yes sir, the qradar box is able to hit the ipa server on 389 and 636 with success via telnet.</font><br><br><br><br><font size="2">Sean Hogan</font><br><br><font size="1" face="Verdana"><br></font><img src="cid:1__=88BB0B89DFE202E98f9e8a93df938690918c88B@" width="67" height="53" align="top"><font size="1" face="Verdana"> </font><img src="cid:2__=88BB0B89DFE202E98f9e8a93df938690918c88B@" width="60" height="51" align="top"><br><br><br><br><br><img width="16" height="16" src="cid:3__=88BB0B89DFE202E98f9e8a93df938690918c88B@" border="0" alt="Inactive hide details for Michael Plemmons ---05/08/2017 01:21:17 PM--->From the server running Qradar can you ping the IPA ser"><font size="2" color="#424282">Michael Plemmons ---05/08/2017 01:21:17 PM--->From the server running Qradar can you ping the IPA server? Are you able to telnet to port 389 or</font><br><br><font size="2" color="#5F5F5F">From: </font><font size="2">Michael Plemmons <<a href="mailto:michael.plemmons@crosschx.com" target="_blank">michael.plemmons@crosschx.com</a><wbr>></font><br><font size="2" color="#5F5F5F">To: </font><font size="2">freeipa-users <<a href="mailto:freeipa-users@redhat.com" target="_blank">freeipa-users@redhat.com</a>></font><br><font size="2" color="#5F5F5F">Date: </font><font size="2">05/08/2017 01:21 PM</font><br><font size="2" color="#5F5F5F">Subject: </font><font size="2">Re: [Freeipa-users] qradar UBA to IPA</font><br><font size="2" color="#5F5F5F">Sent by: </font><font size="2"><a href="mailto:freeipa-users-bounces@redhat.com" target="_blank">freeipa-users-bounces@redhat.<wbr>com</a></font><br></p><hr width="100%" size="2" align="left" noshade style="color:#8091a5"><br><br><br>From the server running Qradar can you ping the IPA server? Are you able to telnet to port 389 or 636 of the IPA server. The error says it can't contact the LDAP server which usually means you have not gotten to the point of authentication yet.<br><br><br><br><br><b><font size="2">Mike Plemmons | Senior DevOps Engineer | CROSSCHX</font></b><br>614.427.2411<br><a href="mailto:mike.plemmons@crosschx.com" target="_blank"><u><font size="2" color="#0000FF">mike.plemmons@crosschx.com</font></u></a><br><a href="http://www.crosschx.com/" target="_blank"><u><font size="2" color="#0000FF">www.crosschx.com</font></u></a><br><br>On Mon, May 8, 2017 at 3:31 PM, Sean Hogan <<a href="mailto:schogan@us.ibm.com" target="_blank"><u><font color="#0000FF">schogan@us.ibm.com</font></u></a>> wrote: <ul><font size="2">Hello IPA,</font><br><font size="2"><br>I am trying to set up User Behavioral analytics from Qradar to IPA. Having some issues with it after we got 389 and 636 open between the nets. </font><br><font size="2"><br>Qradar Console is not in IPA and on differ net although we do have comms on 389 and 636 now<br>ipa-server-3.0.0-50.el6.1.x86_<wbr>64</font><br><br><font size="2"><br>I set up an account in IPA with no HBACS or anything and just gave it a IPA role to read data which we use in the below config.<br>Getting </font><br><img src="cid:4__=88BB0B89DFE202E98f9e8a93df938690918c88B@" width="322" height="51" alt="file:///home/schogan/Documents/SametimeTranscripts/[multi-way]/20170508-100730%7BJUSTIN%20L.%20BAUMAN's%20group%20chat%7D/IMAGE$1CFC0CDDB6F2F123.jpg"><br><font size="2"><br>URL I have them using ldaps://</font><a href="http://ipofipaserver.example.com/" target="_blank"><u><font size="2" color="#0000FF">IPofIPAserver.example.<wbr>com</font></u></a><font size="2"><br>BaseDN dc=example,dc=local<br>filter users,cn=accounts,$Suffix<br>attributes are left default<br>username is the user i made in ipa<br>pw is the pw I made in ipa</font><br><br><br><img src="cid:5__=88BB0B89DFE202E98f9e8a93df938690918c88B@" width="344" height="375" alt="file:///home/schogan/Documents/SametimeTranscripts/[multi-way]/20170508-100730%7BJUSTIN%20L.%20BAUMAN's%20group%20chat%7D/IMAGE$1B778A1810D34E76.jpg"><br><font size="2"><br>Has anyone attempted this or have any sample configs to play with or see anything I am doing incorrect?</font><font color="#888888"><br><br><br><br></font><font size="2" color="#888888"><br>Sean Hogan</font><font color="#888888"><br></font><font size="1" color="#888888" face="Verdana"><br></font><font color="#888888"><br><br><br><br></font><br><br>--<br>Manage your subscription for the Freeipa-users mailing list:<u><font color="#0000FF"><br></font></u><a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank"><u><font color="#0000FF">https://www.redhat.com/<wbr>mailman/listinfo/freeipa-users</font></u></a><br>Go to <a href="http://freeipa.org/" target="_blank"><u><font color="#0000FF">http://freeipa.org</font></u></a> for more info on the project</ul><span class="HOEnZb"><font color="#888888"><tt><font size="2">-- <br>Manage your subscription for the Freeipa-users mailing list:<br></font></tt><tt><font size="2"><a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/<wbr>mailman/listinfo/freeipa-users</a></font></tt><tt><font size="2"><br>Go to </font></tt><tt><font size="2"><a href="http://freeipa.org" target="_blank">http://freeipa.org</a></font></tt><tt><font size="2"> for more info on the project</font></tt><br><br><br> </font></span><p></p></div> </blockquote></div><br></div>