Troubleshooting
Problem
While interfacing with your IBM QRadar SOAR system, or an integration that is tied to your IBM QRadar SOAR system with user credentials, you might encounter behavior that prevents users from logging in.
Symptom
Symptoms of these problems include log messages such as:
08:53:35.231 [http-bio-8443-exec-1] ERROR com.co3.userauth.UserAuthentication - Failed login attempt for user: baduser@example.com, user is banned
Although this message references the particular user that attempted login, the user themselves is not banned, it is the IP address from which they are attempting to log in from which is banned.
If you have a group of users working behind a single IP address such as a proxy, which hides their individual IP address, all users behind that proxy are stopped from using IBM QRadar SOAR.
The same behavior is seen with App Host when a single application is configured incorrectly causing all applications on the App Host from connecting
API keys and their secrets can also cause the IP address of where they are running from being banned.
Document Location
Worldwide
[{"Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSIP9Q","label":"IBM Security SOAR"},"ARM Category":[{"code":"a8m0z000000cvfWAAQ","label":"Authentication"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Version(s)"},{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSA230","label":"IBM Security QRadar SOAR"},"ARM Category":[{"code":"a8m0z000000cvfWAAQ","label":"Authentication"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"},{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSEGM63","label":"IBM Security QRadar SOAR on Cloud"},"ARM Category":[{"code":"a8m0z000000cvfWAAQ","label":"Authentication"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]
Log InLog in to view more of this document
This document has the abstract of a technical article that is available to authorized users once you have logged on. Please use Log in button above to access the full document. After log in, if you do not have the right authorization for this document, there will be instructions on what to do next.
Was this topic helpful?
Document Information
Modified date:
05 January 2024
UID
ibm16365873