Account, user, and entitlements troubleshooting

1. From the home page, under Quick navigation, click Account management.
2. Note the identity providers that are listed in the "Account settings" box.
3. Click Edit account settings. Observe that the number of identity providers in the "Edit account settings" pane does not match the list that you saw in step 2.
4. Click Save changes.

   You see an Account updated message and the identity providers value is updated. When you return to the System Administration account, the accounts list is updated and the account that caused the issue now has the correct value for identity providers.

• Remove a Lightweight Directory Access Protocol directory (LDAP) identity provider by using the IBM Cloud Pak foundational services console.
• Red Hat® OpenShift® Kubernetes Service (ROKS) authentication can only be disabled during an upgrade of QRadar Suite Software.

cpctl remediation sync_ldap --token $(oc whoami -t)

Executing playbook sync_ldap.yaml

- localhost on hosts: localhost -
Gathering Facts...
  localhost ok
Update LDAP directories stored in Entitlements service...
  localhost ok | msg: OK (unknown bytes)
Patch Deployment to Restart Entitlements Pods...
  localhost ok
cp4s namespace...
  localhost ok
Patch Deployment to Restart Pods...
  localhost done
Show LDAP sync status...
  localhost ok: {
    "changed": false,
    "msg": "LDAP directories are in sync"
}

cpctl diagnostics check_deployment --only entitle --token "$(oc whoami -t)"

1. To find the namespace where QRadar Suite Software is installed, run the following commands.

   NAMESPACE=$(oc get pod -lname=cp4s-extension --all-namespaces --no-headers 
   awk '{print $1}')

   echo $NAMESPACE

2. To identify a running isc-entitlements pod, run the following commands:

   POD=$(oc get pods -lname=isc-entitlements -n=$NAMESPACE --no-headers | grep -i running | head -1 | awk '{print $1}')

   echo $POD

3. Confirm that result of step 1 is similar to the following output.

   isc-entitlements-c5bc499ff-2qwb5

   1. If no output results from the isc_entitlements command, run the oc get pods -lname=isc-entitlements command and verify that pods are present and are in a Running state.
   2. If no pods are in the Running state, see the instructions for running MustGather.

4. To find the ID for the System Administration account, run the following command:

   oc exec $POD -n=$NAMESPACE -- node ./utilities/listAccounts.js

   Obtain the ID from the output as shown in the following example:

   ┌─────────┬────────────────────────────────────────┬──────────────────────────────────┐
   │ (index) │               Account ID               │           Account Name           │
   ├─────────┼────────────────────────────────────────┼──────────────────────────────────┤
   │    0    │ '88bb81d6-2e5a-4ca2-b5ee-f5d2f391d549' │     'System Administration'      │
   │    1    │ '9b0a1cb6-97b3-42aa-88e7-11e428eee301' │     'Test account 1'             │
   │    2    │ 'a6be0459-5a69-40fd-aea6-847a6792a781' │     'Test account 2'             │
   │    3    │ 'a8bb651d-5f9b-4447-802e-a1d3a514d988' │     'Test account 3'             │
   └─────────┴────────────────────────────────────────┴──────────────────────────────────┘
   

5. Run the setAdminUser command with the user ID of the new Admin and the account ID of the System Administration account.

   oc exec $POD -n=$NAMESPACE -- node ./utilities/setAdminUser.js <username> <account_ID>

   If the user does not exist on the account, the command searches the Lightweight Directory Access Protocol (LDAP) directories that are connected to IBM Cloud Pak foundational services. If the specified user is found, that user is added to the System Administration account and given the accounts management Admin role on that account.

   The following log is an example of the output from the command:

   {"level":"info","message":"Getting connected LDAP directories...","ibm_datetime":"2021-09-14T12:04:22.635Z"}
   {"level":"info","message":"Searching LDAP directories for test.user@company.com...","ibm_datetime":"2021-09-14T12:04:23.411Z"}
   {"level":"info","message":"Found test.user@company.com: b6736880-eba5-11eb-934d-9d3351e73cde#uid=I00206754,c=ie,ou=bluepages,o=ibm.com, adding user to account","ibm_datetime":"2021-09-14T12:04:24.299Z"}
   {"level":"info","message":"User 'test.user@company.com' has been provisioned in account '88bb81d6-2e5a-4ca2-b5ee-f5d2f391d549'. Current subscription: a7a63e2e-d6cb-4ced-be7b-af7473d2138b","ibm_datetime":"2021-09-14T12:04:27.204Z"}
   {"level":"info","message":"Attempting to give test.user@company.com Admin role on all applications in account 88bb81d6-2e5a-4ca2-b5ee-f5d2f391d549","ibm_datetime":"2021-09-14T12:04:27.205Z"}
   {"level":"info","label":"system-account","message":"Attempt to set: \"test.user@company.com\" as Admin on 3 applications","ibm_datetime":"2021-09-14T12:04:27.425Z"}
   {"level":"info","message":"Complete","ibm_datetime":"2021-09-14T12:04:27.632Z"}