Multi-Tenancy and Hypermap

[jacek]

Hello,

I'm trying out the Multi-Tenancy functionality in Nagios XI, which seems to work very well for the purposes I'm aiming at, but (why there always needs to be a but? ) the hypermap is not working.

I've added one user, with the following permissions:

Security.PNG

Now, I've added him to notification list on 7 hosts, starting up from the "localhost" and ending up at some end point.
The child/parent configuration is like this 1->2->3->4->5->6->7.
When I go to the hypermap view, there is an error showing, that: "You are not authorized to view all hosts and services."

Can this be somehow "fixed", so it would only view the hosts that the user can monitor?
Hypermap is really simple and cool, but I don't want to give access everybody to view all hosts so they can run hypermap...

BTW.
The Network Status Map is working almost fine, showing only the 7 hosts, connected to each other in the balloon view, but in the tree view it looks like it is only "hiding" all the other hosts so at my 100 hosts this looks really stupid:

[hsmith]

What version of XI are you running? I can attempt to reproduce these and file bug reports.

[jacek]

Hi, I'm on Nagios XI 5.2.2 (the latest one), thus didn't check this solution on the previous versions, but suppose this didn't work either...

[hsmith]

When I go to the hypermap view, there is an error showing, that: "You are not authorized to view all hosts and services."

I can reproduce this, but for now, it sounds like this going to be the intended functionality. We may make some enhancements to make it less deceptive, and remove the link, but right now it's not changing.

The Network Status Map is working almost fine, showing only the 7 hosts, connected to each other in the balloon view, but in the tree view it looks like it is only "hiding" all the other hosts so at my 100 hosts this looks really stupid:

I could put in a feature request, but I can't promise any sort of timeline. What would you like to see it do instead?

[jacek]

I can reproduce this, but for now, it sounds like this going to be the intended functionality. We may make some enhancements to make it less deceptive, and remove the link, but right now it's not changing.

That's bad, hypermap is briliant in it's simplicity, I think it would be better to let hypermap process only the viewable host for the current user.

I could put in a feature request, but I can't promise any sort of timeline. What would you like to see it do instead?

To act as the hosts that are viewable by this user were the only ones.
So the tree wouldn't get that split up, because of all those "hidden" hosts.

[hsmith]

To act as the hosts that are viewable by this user were the only ones.
So the tree wouldn't get that split up, because of all those "hidden" hosts.

It gets tricky when you have parents though, since it kind of indicates 'levels'.

Do you think it should look almost like a 'spiral?' Have you compared it with something that doesn't have parents?

[jacek]

Maybe I expressed this wrong.
The levels in the tree are ok, this is what it's made for, but it gets to wide because of all of the hidden hosts, it should be almost like the balloon view when there is only one route, shouldn't it?

[tmcdonald]

I think I understand what you're saying, I am just not a very artistic person so I can't photoshop it up :)

Consider this though: Host A is a child of Host B which itself is a child of Host C. You are a contact assigned only to A and C - what should it display in this case? Clearly there is a host between A and C but since you are not allowed to view it removing it would imply that A is a direct child of C, which is not true.

For the tree view I suppose we could indicate there are hosts for which a user does not have permissions, and just collapse/condense them. Is this more of what you were looking for?

[jacek]

Hi,

I got hypermap working the way I want.
It now displays only the hosts that the user can see and if there are nodes that have no parents they get attached to nagios process (as it is when You don't define relationships).

To get this done open this file:

Code: Select all

/usr/local/nagiosxi/html/includes/components/hypermap/index.php

And comment out the whole section:

Code: Select all

    // Only certain people can see this
    if (is_authorized_for_all_objects() == false) {
        echo gettext("You are not authorized to view all hosts and services.");
        exit();
    }

Like this:

Code: Select all

    // Only certain people can see this
    //if (is_authorized_for_all_objects() == false) {
    //    echo _("You are not authorized to view all hosts and services.");
    //    exit();
    //}

This will prevent hypermap checking if the user "is_authorized_for_all_objects".

Most propably this will be overwritten by any hypermap update.

BTW. it would be nice if this section could be enabled and disabled from hypermap component configuration and disabled by default.

[rkennedy]

Thanks for letting us know how you solved this! I went ahead, and filed a feature request with our developers to add this in. The ID is #7668.

Do you mind if we close this thread out now, as the FR has been filed?