BPI User Permissions Not Working

[mikew]

I am trying to get multi-tenancy to work with BPI. Here you can see multi levels of BPI groups. Each group has the user (not an admin) added to the group.

bpi2.png

However, the muti-tenancy only seems to work with the top group, it does not go any lower as the user can only see the top group even if they are a part of the other groups.

bpi1.png

The user is a contact for all of the hosts and still cannot see them.


Any way to get this to drilll down through the other levels?

[lmiltchev]

Mike, I was able to recreate the issue on my test box. I will talk to our developers. We will need to do some more digging into this to identify the issue.

[mikew]

Thanks, much appreciated.

[lmiltchev]

Mike, after some testing I found out that an "authorized user" in BPI could view ALL levels of BPI groups (top level group + sub-groups) but ONLY if this user has been added as a monitoring contact to all members of the hostgroups in Nagios XI (i.e. via the CCM).

That tells me there is some room for improvement in regards to BPI integration.

Also, I noticed something weird - after removing the monitoring contact from one of the members (the only member) of one of the hostgroups (lowest BPI group), the user was still able to see in in BPI (but not in the XI - Home->Hostgroup Summary).

I think I will post an internal bug report/feature request on the issue but I don't know when/if this is going to be fixed.

[mikew]

So what we are dealing with is a company that would like to separate out the network infrastructure from the servers. So they want to allow network people to use BPI to see only network gear. However, if they are not added to all of the servers they cannot use BPI. So it is a catch 22: if they are a contact for all hosts...it is overwhelming....if they only see network they cannot see BPI below the top.

[lmiltchev]

I just spoke to our developers. They said this is out of the scope of BPI (what it is intended to do). You can set up BPI groups and set an authorized user to the top BPI group and all sub-groups below it, but you will still need to allow this contact to see the object (in the CCM)... I don't think the BPI will be reworked with adding a "CCM type of functionality".
But I can see your point. I guess if you want to "allow network people to use BPI to see only network gear", they should be added as a monitoring contacts to "network" hosts. This shouldn't be too difficult thing to do if you use Enterprise + the Bulk Modifications Tool.

[mikew]

Yes that is what we are trying to do that does not work. The network people have been added as a contact to all network hosts but in BPI can only see the top level, not the other levels even though they are contacts for all of those devices in those levels. Again, this is with multi-tenancy which I think is the standard that should be working with BPI.

[lmiltchev]

Mike, when the contacts are added, the "authorized" user should see the whole tree in BPI... There must be something wrong with the configs. Can you open a ticket in our email ticketing system by emailing us at [email protected]? I will gladly test the configs in house and try to identify the issue. Thanks!

[mikew]

I have replicated this problem on three Nagios XI installs. So it looks like an issue with BPI permisions.

[lmiltchev]

Mike, it's working fine for me...

I created a really simple setup. I have 4 "test" houstgroups in XI (GROUP1, GROUP2, GROUP3 and GROUP4) with one host added to each one as a member.

In BPI (logged in as "nagiosadmin"), I created a new BPI group called "GROUP-TEST" and added the GROUP1-4 underneath it. I set "ludmil" as an "authorized user" on all of the BPI groups - "GROUP-TEST", GROUP1, 2, 3 and 4.

Note: User "ludmil" is added as a monitoring contact to all hosts, members of GROUP1, 2, 3 and 4 and their services.

When I log in as "ludmil" I can view ALL of the BPI groups (the whole tree) - here's a screenshot (I expanded the last group for you to view):

example01.PNG