Nagios integration with freeIPA

[paktusjet]

Has anyone successfully integrated their nagios web front end into free IPA?

[tmcdonald]

There doesn't appear to be a ton of information regarding the two, so my guess would be no.

What sort of integration are you looking to achieve? Do you just want to monitor the freeIPA application or are you looking to actually tie the interfaces together somehow?

[paktusjet]

We had Nagios's web front end integrated to Active Directory for a while. Now that we are switching over to freeIPA I need to be able to login using IPA credentials on the web front end of Nagios.

[abrist]

As long as the FreeIPA user is passed through to apache so that the cgi auth can be checked, this should be possible. But it is untested and undocumented with Nagios. I would start by backing up your current apache vhost and auth files before pushing forward with a test. You will need to configure apache for FreeIPA auth. I found a large number of docs on this, but as it is an unrelated technology to nagios, you probably already know best how to implement FreeIPA with apache. Some of the docs (of unknown quality) I have found:
https://www.freeipa.org/page/Apache_Gro ... horization
http://www.server-world.info/en/note?os ... httpd&f=22

If you have not read it, the FreeIPA documentation:
https://www.freeipa.org/page/Documentation

The doc below seems to imply that FreeIPA can use the standard REMOTE_USER env var like apache (and nagios), which means this should be possible (on face at least). Check it out!
http://www.freeipa.org/page/Web_App_Authentication

[paktusjet]

Thanks for the direction. So digging a little here and there with your notes as well I was able to link nagios's web front end to IPA, but now it's a permission issue when it comes to nagios and the user account. When I log in now with my IPA credentials I get a permission denied on all services and what not. Any idea on how to point nagios's web front end to use the group permissions from IPA?

[jdalrymple]

Nagios performs its authentication based upon the user apache presents. There is no way to change that. If the username matches up with the contact - permission granted. If not - permission denied.

Start with your apache access_log to see what users are getting handed over to Nagios.

[fm2ahmed]

Hi,

Can you please guide me to the step-by-step procedure as to to how you configured the Nagios WEBUI to integrate with FreeIPA??

Regards,
Farooq Ahmed

Thanks for the direction. So digging a little here and there with your notes as well I was able to link nagios's web front end to IPA, but now it's a permission issue when it comes to nagios and the user account. When I log in now with my IPA credentials I get a permission denied on all services and what not. Any idea on how to point nagios's web front end to use the group permissions from IPA?

[tmcdonald]

Did you follow the advice offered by @abrist and @jdalrymple above? This thread is almost a year old, so I don't think that @paktusjet will be coming back to answer you directly.

[fm2ahmed]

Hi,

Yes i did but was unable to successfully implement it, thats why the question. Can you help me out with it?

Regards,
Farooq Ahmed

Did you follow the advice offered by @abrist and @jdalrymple above? This thread is almost a year old, so I don't think that @paktusjet will be coming back to answer you directly.

[tmcdonald]

What specific issues are you running into? We can help out somewhat, but we'll need to know more about what steps you took, what is failing, any error messages, etc.