[sentinel-intel/sentinel-incident]

[pierremahot]

Use case

have better log on the sentinel connector checking the role inside the jwt token to have clear info on what is missing

Current Workaround

do the verification outside of the connector

token=$(curl --location --request POST "https://login.microsoftonline.com/$SENTINEL_INTEL_TENANT_ID/oauth2/v2.0/token" \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode "client_id=$SENTINEL_INTEL_CLIENT_ID" \
--data-urlencode 'scope=https://graph.microsoft.com/.default' \
--data-urlencode "client_secret=$SENTINEL_INTEL_CLIENT_SECRET" \
--data-urlencode 'grant_type=client_credentials'| jq -r .access_token)
# jwt decode token =>
{
    "aud": "https://graph.microsoft.com",
    "iss": "https://sts.windows.net/xxxx...xxxx/",
    "iat": xxxx...xxxx,
    "nbf": xxxx...xxxx,
    "exp": xxxx...xxxx,
    "aio": "xxxx...xxxx",
    "app_displayname": "OpenCTI",
    "appid": "xxxx...xxxx",
    "appidacr": "1",
    "idp": "https://sts.windows.net/xxxx...xxxx/",
    "idtyp": "app",
    "oid": "xxxx...xxxx",
    "rh": "xxxx...xxxx",
    "roles": [
        "ThreatIndicators.ReadWrite.OwnedBy"
    ],
    "sub": "xxxx...xxxx",
    "tenant_region_scope": "EU",
    "tid": "xxxx...xxxx",
    "uti": "xxxx...xxxx",
    "ver": "1.0",
    "wids": [
        "xxxx...xxxx"
    ],
    "xms_idrel": "xxxx...xxxx",
    "xms_tcdt": xxxx...xxxx
}

the current side effect is that the connector are not stopping just spamming a lot of log not really great.

Proposed Solution

add check of the role present on the token get with the first auth stage and stop the container if the role are not sufficient with a beautifull log

Additional Information

current auth

connectors/external-import/sentinel-incidents/src/sentinel_incidents_connector/client_api.py

Line 25 in 1b8e373

def _get_oauth_token(self) -> str:

connectors/stream/sentinel-intel/src/sentinel_intel_connector/api_handler.py

Line 33 in 1b8e373

def _get_authorization_header(self):

Would you be willing to submit a PR?

may be