"can see all objects" in template?

[teh0015]

I want all users who get a particular contact template to get "can see all objects"
Can this be done? Is there maybe a better way to do it that I'm not thinking of?

[tmcdonald]

Not possible using a template, since this is a user setting and not a contact setting (they are related but different). It will need to be set at the user level.

[teh0015]

hmmm... so how would you suggest I go about making this change for 245 users?
I don't see that it's something I have access to via 'bulk actions'.

[mcapra]

There isn't a nice neat automated way to do that that I can think of.

You could probably write an SQL query to do that, but there isn't really anything tying XI users to Core contact groups. Also, we don't officially support direct database manipulation as it can break your XI installation pretty fast if not done with extreme care.

DISCLAIMER: I am not a developer and the following comes with no guarantee of reliability or safety. You should definitely, at the very least, back up your XI installation and take a VM snapshot before doing any direct database manipulation.
Here's a (really ugly and poorly formed) query that gets the "authorized for all objects" flag for XI users in the contact group "admins":

Code: Select all

SELECT * FROM nagiosxi.xi_usermeta WHERE keyname='authorized_for_all_objects' AND user_id IN (
	SELECT user_id FROM nagiosxi.xi_users WHERE username IN (
		SELECT contact_name FROM nagiosql.tbl_contact WHERE contact_name IN (
			SELECT contact_name FROM nagiosql.tbl_contact WHERE id IN (
				SELECT idSlave FROM nagiosql.tbl_lnkContactgroupToContact WHERE idMaster IN (
					SELECT id FROM nagiosql.tbl_contactgroup WHERE contactgroup_name='admins'
				)
			)
		)
	)
)

You might considering updating the keyvalue to 1 for all of those entries. Replace WHERE contactgroup_name='admins' with your preferred contact group.

[teh0015]

I want *everyone to be able to view all monitors. (not modify)
Does the below look like it would accomplish that?

UPDATE xi_usermeta SET keyvalue='1' where keyname='authorized_for_all_objects';

[mcapra]

That worked on my testing system (CentOS 7, XI 5.2.9) for every user.

[mcapra]

Forgot to mention, if read-only is required make sure the readonly_user keyname also has a value of 1 for a given user.

[teh0015]

I just went through and did this on all my users and it seems to work as expected.
Thanks!

I flipped everyone to 0 for readonly and went back and modified the few accounts that I want to always be readonly.
My understanding is that people will still only be able to modify a monitor if they're listed as a contact .. is this correct?

[mcapra]

The "read-only" setting supersedes the "Can (re)configure hosts and services" setting. If you set a user to "read-only", they will not be able to modify hosts and services.

To my knowledge, there isn't any way to say "UserX can only modify objects [1,2,3], but can view all other objects".