SOAR - User can not login to SOAR Web UI after OS patching

Applicability

Description

After the OS RHEL8 patching, users failed to login to web UI with Error promoted as below: 

duplicate validator function "phantom_ui.ui.model_managers.mission_control_role_manager.ParsedCapability.perm_type_must_be_soar_supported"; if this is intended, set `allow_reuse=True`

Investigation

Running the command on SOAR to collect DIAG files:

$ <PHANTOM_HOME>/bin/phenv python <PHANTOM_HOME>/www/manage.py diag

In the output diag JSON file, it shows packages being installed outside of SOAR and the version mismatching:

"Packages added to system outside of Splunk SOAR": [
                "anyio (4.4.0)",
                "authlib (1.3.0)",
                "azure-core (1.28.0)",
                "azure-storage-blob (12.17.0)",
                "azure-storage-file-share (12.13.0)",
                "azure-storage-queue (12.6.0)",
                "click (8.1.7)",
                "configparser (4.0.2)",
                "deep-security-api (20.0.463)",
                "et-xmlfile (1.1.0)",
                "exceptiongroup (1.2.0)",
                "h11 (0.14.0)",
                "httpcore (1.0.5)",
                "httpx (0.27.0)",
                "ioc-fanger (4.2.1)",
                "msal (1.29.0)",
                "openai (1.37.0)",
                "openpyxl (3.1.2)",
                "pandas (2.0.3)",
                "ply (3.11)",
                "plyara (2.1.1)",
                "pydomo (0.3.0.9)",
                "pyodbc (4.0.39)",
                "pyparsing (3.1.1)",
                "pyral (1.5.2)",
                "pysigma (0.9.11)",
                "pysigma-backend-microsoft365defender (0.2.0)",
                "pysigma-backend-splunk (1.0.2)",
                "pyspnego (0.9.2)",
                "randori-api (1.5.0 cf70b98)",
                "requests-ntlm (1.2.0)",
                "smartsheet-python-sdk (3.0.2)",
                "sniffio (1.3.0)",
                "tqdm (4.62.3)",
                "tzdata (2023.3)",
                "valhallaapi (0.6.0)",
                "xlsxwriter (3.1.2)",
                "xmltojson (2.0.2)",
                "yara-python (4.3.1)"
            ],
            "Packages that are version mismatched from Splunk SOAR": [
                "pip (21.2.4 -> 23.3)",
                "setuptools (58.1.0 -> 68.0.0)"
            ]

Resolution

The issue was due to a problematic python package "openai" that upgraded a SOAR dependency to a higher version than SOAR must support. Please follow the steps below to resolve the issue:

  1) Removing openai package        

$pip uninstall openai

  2) Force downgrading typing_extensions 

$pip install --force-reinstall -v "typing_extensions==4.5.0"