User Access Control

rajasegar · Post by **rajasegar** » Fri Apr 18, 2014 7:29 pm

Nagios XI 2012R2.9
RHEL 6.5 x64
Manual Install

1) How to I assign a user where, they can enter comments, acknowledge alerts, schedule downtime but cannot do an other functions?
2) Restrict user view to only some hostgroups or service groups?
3) Stop some users from running reports

Thanks

Post by **Box293** » Fri Apr 18, 2014 9:49 pm

This might be a good starting point: http://library.nagios.com/library/produ ... -nagios-xi

The ability to configure Nagios to monitor multiple clients' systems, while segregating user permissions and access rights, is an important feature for many organizations and managed service providers. This guide shows you how to configure Nagios XI to support multi-tenancy.

rajasegar · Post by **rajasegar** » Sat Apr 19, 2014 12:46 am

Box293 wrote:This might be a good starting point: http://library.nagios.com/library/produ ... -nagios-xi

The ability to configure Nagios to monitor multiple clients' systems, while segregating user permissions and access rights, is an important feature for many organizations and managed service providers. This guide shows you how to configure Nagios XI to support multi-tenancy.

Thanks for the help.

tmcdonald · Post by **tmcdonald** » Mon Apr 21, 2014 9:01 am

Did that get you what you need? If so I would like to close up this thread.

rajasegar · Post by **rajasegar** » Mon Apr 21, 2014 6:32 pm

tmcdonald wrote:Did that get you what you need? If so I would like to close up this thread.

Hosts & services visibility is fine but I still cant find a way to selectively do the following :-
1) Disable reporting for some users
2) Allow only adding comments and acknowledgement and disable the other advanced functions

Please advice on this.

abrist · Post by **abrist** » Tue Apr 22, 2014 9:48 am

rajasegar wrote:1) Disable reporting for some users

This is currently not possible. Reports can be created for any object that a user is are a contact of.

rajasegar wrote:2) Allow only adding comments and acknowledgement and disable the other advanced functions

These activities require rights to reconfigure the object as they can essentially change behavior (silence alerts, etc.)

These may be good feature requests, maybe open up feature requests at: http://tracker.nagios.com

rajasegar · Post by **rajasegar** » Mon Apr 28, 2014 9:37 pm

Nagios XI Ent 2012R2.9
Manual Install

I have tried everything described in the Multi tenancy document however the contact created cannot see any of the host defined.

My setup has the following
1) A bunch of servers assigned to hostgroup HG-ESB-PROD
2) HG-ESB-PROD is assigned template HTPT_ESB_PROD
3) Host template HTPT_ESB_PROD has host group HG-ESB-PROD and contact group GRP_APP_ESB assigned to it.
3) Contact group GRP_APP_ESB has a user called APP_ESB_GROUP in it.
4) APP_ESB_GROUP has user has only readonly access option ticked.

However when app_esb_group logs in nothing can be seen. How do I troubleshoot this?

slansing · Post by **slansing** » Tue Apr 29, 2014 1:36 pm

2) HG-ESB-PROD is assigned template HTPT_ESB_PROD

By this I suppose you meant that all of the hosts have that template on them? Hostgroups cannot be assigned templates.

Further reading shows that it sounds like that is true, but you actually assigned a host group in that template, not the actual hosts directly to the host group. You also have contact group "GRP_APP_ESB" assigned to that template? Am I correct in reading that you not only have a contact group named "APP_ESB_GROUP" but a contact named that in a jumbling of the words??? "APP_ESB_GROUP"

So all in all you have a user named "APP_ESB_GROUP" and they have a contact created with them named "APP_ESB_GROUP" and that contact is assigned to group "APP_ESB_GROUP" which is assigned to host template "HTPT_ESB_PROD" which is assigned to every single host in host group "HG-ESB-PROD".

Are you sure the contact name is exactly the same as the user's name? In every way? Do other contacts in that group who have users see the objects in that group as well?

rajasegar · Post by **rajasegar** » Tue Apr 29, 2014 6:29 pm

slansing wrote:
2) HG-ESB-PROD is assigned template HTPT_ESB_PROD
By this I suppose you meant that all of the hosts have that template on them? Hostgroups cannot be assigned templates.

Further reading shows that it sounds like that is true, but you actually assigned a host group in that template, not the actual hosts directly to the host group. You also have contact group "GRP_APP_ESB" assigned to that template? Am I correct in reading that you not only have a contact group named "APP_ESB_GROUP" but a contact named that in a jumbling of the words??? "APP_ESB_GROUP"

So all in all you have a user named "APP_ESB_GROUP" and they have a contact created with them named "APP_ESB_GROUP" and that contact is assigned to group "APP_ESB_GROUP" which is assigned to host template "HTPT_ESB_PROD" which is assigned to every single host in host group "HG-ESB-PROD".

Are you sure the contact name is exactly the same as the user's name? In every way? Do other contacts in that group who have users see the objects in that group as well?

Well maybe I was not very clear. Here is the summary

Host Template -> HTPT_ESB_PROD
--- HostGroup -> HG-ESB-PROD -> Assigned All the ESB hosts
--- Contact Group -> GRP_APP_ESB -> APP_ESB_GROUP (contact)

The user is in lower case (app_esb_group), that is the only difference between it and the contact itself.

Post by **lmiltchev** » Wed Apr 30, 2014 9:28 am

It would be easier to troubleshoot the issue if we could take a look at the actual configs. Go to: Admin->System Profile->Download Profile->save and email us the "profile.zip" at xisupport@nagios.com. Type "Re: User Access Control" in the email's subject field. Thanks!