Admin Authorization Level not applying to AD Imported Users

[lmiltchev]

Let's step back for a minute, and verify something. Do you have "matching" xi users (Admin > Manage Users) to your contacts (CCM > Contacts), including matching the case? Have you created "xi user -> contact" relationships after importing your contacts to Nagios XI as described in the document below?

https://assets.nagios.com/downloads/nag ... ntacts.pdf

Maybe, we can start troubleshooting with one contact/xi user, and go from here. Again, we haven't been able to reproduce the issue in-house so far.

[MediaworksNZ]

Hi,

The Contacts were created (Imported) before the Users were added via AD.
The Case is the same for Contacts and Users.
There are more Contacts as users and there are disabled Contacts if this has any bearing.

Checking one of the contacts in the new build vs the Old server, there are missing settings that are different:
Missing Host Notifications Timeperiod (Blank) and Host Notification options are different to the Old System.
Missing Service Notifications Timeperiod (Blank)

I see that the documentation advises that this must be set to <username>_notification_times, but I see that the users I tested with have it set to 24x7 or is blank.
Can you confirm that time periods can be different like 24x7 or does it need to be <username>_notification_times?

Thanks

Craig

[lmiltchev]

Can you confirm that time periods can be different like 24x7 or does it need to be <username>_notification_times?

Yeah, the time periods could be different, e.g. 24x7. This is not an issue.

Can you give us a bit more information?

1. Give us a specific example with a xi user/contact. Show the actual contact definition, a screenshot of the security settings for the user (Admin > Manage Users > Edit), and a screenshot of the error you are seeing in the GUI (when logged in as this user).

2. Run the following commands, and show the output:

Code: Select all

ls -l /usr/local/nagios/etc/cgi.cfg
grep <username> /usr/local/nagios/etc/cgi.cfg
grep <username> /usr/local/nagiosxi/etc/htpasswd.users

where you substitute <username> with the actual username.

3. How are you testing user permissions? Are you loggin in as this user (including accepting the license agreement) or you are just masquerading as this user?

4. Can you test the same scenario in Nagios XI 5.6.3? Are you having the same issues as in XI 5.6.2?

[MediaworksNZ]

Hi @lmiltchev

Right, so I decided to do the following.

• 1. Delete Time Periods for all users that were imported
  2. Deleted the Contacts for AD imported users
  3. Deleted the XI Users that were imported from AD
  4. Applied configuration
  5. Imported Users from AD, Set them as Monitoring/Alerting Contacts, set Admin and API Access
  5. Completed the import
  6. Set Host/Service Notification Commands and Contact Groups for the user contact.
  7. Applied Configuration.

Tested and confirmed that the Admin Role is being applied correctly to the AD imported users.

Must have been something to do with the import of the user contacts and Time periods that messed things up.

Thanks for everyone's help, hopefully this will help someone else in the future.

[lmiltchev]

Thank you for the feedback! I am glad your issue has been resolved! I am closing the topic.