XI Contacts and User Account Association Feature Request

[emartine]

I have read the multi-tenancy document and the understanding XI users and contacts documents but I've had several requests from folks to only get pager alerts only for critical servers and emails alerts only for test type servers. I understand the need for this and it can be done with multiple accounts but multiple accounts means the user will need to log in with different credentials to view those servers which they are accountable for. Unfortunately NagiosXI doesn't allow association of multiple contacts with a single user account to allow this and my work around is to allow view and commands for all folks (logging everything making them accountable for their actions). Maybe I am thinking about this the wrong way but perhaps there is a different way to be flexible or this can be implemented as a feature? Any thoughts on this would be greatly appreciated.

[eloyd]

Personally, I think the Nagios contact/user management needs an overhaul. It's becoming increasingly difficult to have a simple separation based on notfiications into multiple tenants. Separating based on host groups and service groups would be AWESOME and more easily allow for atypical notification methodologies to be used when simple "email me when things are wrong" does not suffice.

[tmcdonald]

First off, sorry we didn't catch this. There was a time when this section of the forum was not tied into the support team's workflow, so it slipped through. Better late than never?

I asked the devs if we are planning on doing anything with users in 5.3.0 and aside from the half dozen or so things in the changelog right now, we're not doing anything major. Definitely on the roadmap, but not for 5.3.0.

From my conversation with them, this is what I suggested:

[To have] an X to Y sort of relationship for users and contacts might not be awful.  Users maintain a list of the contacts for which they should be associated, so you can have 10 users for 1 generic contact, or 10 contacts for 1 generic user, etc. etc.

Not sure if this will be implemented, but what are your thoughts?

[eloyd]

Like I said, I am on a hunt for very old, open issues I can respond to.

Personally, I think basing multi-tenancy on contacts is bad. It makes for awkward workarounds for hosts/services that you want to see on the GUI but not be notified about if something goes wrong. Maybe it's a dependency trigger or part of a BPI group and you only care about the final stage of the chain.

Tying multi-tenancy to hostgroups (and/or servicegroups) makes the most sense to me, since one could easily make a "Network Hosts" and "Webserver Hosts" and "Database Hosts" hostgroup and drop machines into it, assigning users to the appropriate hostgroups (or whatever the nomenclature would be) once, and then forgetting about it as new hosts get added. Same applies to servicegroups.

[tmcdonald]

Just an idea I had, never said it was good :)

The conversation is definitely happening, just keep an eye on the changelogs!

[fpernet]

Hi All,

I **think** that the request i was ready to ask is lied to the subject.

My enhancement request was about contact groups synchro with Active Directory Groups. It means that you can select some groups when attached to an AD, and create on the fly the corresponding contact groups in nagios. Then you will be notified and will be able to view only hosts/services lied to these contact groups. The rest of the management can be done entirely inside AD after that.

On your side, you want to be able to lie an AD account to multiple Nagios contacts. I am fully agree with that.

On my side, i would like that local ContactGroups and AD ContactGroups exist. You can manually add/remove membership for local ContactGroups and for AD ContactGroups, management is done from the AD.

Both together: ADaccount can be lied to multiple localAccounts. Local Account can be member of multiple LocalCG. ADaccount can be lied to multiple AdCG.

Plus the fact (as eloyd says) to lie account/contact to HostGroups/ServiceGroups ...

Now we start to have the big picture ...

Just an idea, but when we say to customers that we can do a AD authentication, the question of the Groups raises immediatly ...

[tmcdonald]

I'm not sure what you mean when you say "to lie" but we are definitely working on the LDAP options across XI and our other products.

[eloyd]

I think he meant "to link."

[fpernet]

Yes... sorry for my english ... to link, no to lie ...
Happy to hear that LDAP options will be enhanced...

[tmcdonald]

As this is a feature request thread and the developers are aware of the issue, I will be closing the thread now.