Page 3 of 4
Re: LDAP authentication
Posted: Tue Apr 13, 2010 2:43 pm
by mmestnik
Box293 wrote:Box293 wrote:* Perhaps the ability to pull the users email address from AD so it knows your email address to send notifications to if required.
mmestnik wrote:So until there is some more information about how AD works and is structured these endeavors are hopeless.
My mistake here, I was not specific enough, what I should have said is: Perhaps the ability to pull the users Exhange Server 2007 email address from AD so it knows your email address to send notifications to if required.
Exchange server stores it's information about user account details (like an email address) in AD. Each object in AD has attributes that these values are stored in. When an Exchange server is used in AD, the users primary email address is stored in the attribute
mail. In addition to this all email addresses that the user has (not uncommon to have two or three different addresses per user) is stored in the attribute
proxyAddresses.
Alternatively, if Exchange server is not the organisations choice of email server, you can actually put the email address in any empty attribute field like pager, notes, mobile etc. The point I am making here is that in the Nagios XI AD integration module you could allow us [the end user admin] to specify what AD attribute we have used to store the users email address. This allows you to provide a functionalilty of pulling an email address from AD but being flexible enough to suit many different environments without being too strict.
Once again, the purpose of pulling the email address from AD removes an administrative overhead, if I don't need to manually type it into Nagios XI and it can be automatically pulled from AD that is great. If a user changed their name (like when getting married) then their new email address would be automatically updated without any additional administrative overhead.
This specifically causes problems for any application attempting to use LDAP, I say attempting because this is more problematic then simply practicing medicine or law.
http://www-archive.mozilla.org/projects ... /ldap.html
http://bugzilla.mozilla.org/show_bug.cgi?id=119291
At some point you just have to give up and say, if it can't be done it can't be done and stop trying or you end up hurting more then just yourself. Though it seams like progress is being made on this front, go go Thunderbird fly.
https://bugzilla.mozilla.org/show_bug.cgi?id=324389
Re: LDAP authentication
Posted: Tue Apr 13, 2010 2:53 pm
by mmestnik
Box293 wrote:Box293 wrote:* I DO NOT want usernames to be case sensitive. I don't care if the user logs in as UserLast1 or userlast1, only the password should be case sensitive.
To put it another way, in AD usernames are not case sensative when a user performs an authentication request. If you are going to be athenticating user accounts stored in AD AND you are going to be case sensative then you are going to be running into problems. And on top of that you are trying to force a standard onto a user that they are not used to and isn't required for any reason at all. All you will be doing here is frustrating the user! If they don't remember to type their username a particular way and are denied access then they will need to re-enter their credentials a second time just to log on. At this point the user has probably been put in a negative state of mind and all they'll be thinking is "stupid program blah blah blah,". That negative experience is the thing that they will more than likely tell other users when talking about Nagios, that is just human nature. About 2 out of 10 people will tell someone else how good something is, 9 out of 10 people will tell someone else how
bad something is.
I hope all of this helps you understand why I put forward nine reasons for what I would like with LDAP / AD authentication. Please ask me for more details if required as I am more than willing to help.
I get where you are coming from. Though I feel it's important for you to understand this isn't even .01% of the case sensitive problem, for example imagine what making host names and URLs case insensitive would do.
Re: LDAP authentication
Posted: Thu Apr 15, 2010 3:20 pm
by tonyyarusso
Box293: I haven't worked with AD much, but I do have a general sense of how it works, fyi. It sounds like the stuff you're looking for should be technically possible, but varying degrees of "lots of work". We'll see what happens.
As far as making usernames case-insensitive, that should be easy if the server doesn't care - just send the query and off we go. For actually storing and referencing them within XI, we can just use a string-to-lowercase function on the input - simple. There's no reason adapting this field should affect other fields.
For pulling things like e-mail addresses, while it's true that LDAP allows for completely free-form schema, there are a small handful of commonly used "standard" ones, so we can probably support those OOTB, with possibilities for manual configuration if necessary as a fallback to consider.
Re: LDAP authentication
Posted: Thu Apr 15, 2010 10:55 pm
by Box293
Thanks Tony.
If I had to choose what feature would be available to me in the first release I would be happy with being able to associate AD users with Nagios XI users.
Groups and the other stuff can come later, the ability to just login with my AD account and password would be enough to get me by until more configration options were available.
Soooooo many suggestions ... not enough hours in each day 
Re: LDAP authentication
Posted: Fri Apr 16, 2010 12:49 pm
by mmestnik
One way to look at things is that usernames can be shadowed(contacts auto-provisioned) and also use Kerbose/AD(NT LAN Manager, this is the simple SMB auth protocol used in Windows Workgroups) to handle the authentication. It won't use LDAP, but if that's what you are looking for then I'm with Admin and Tony... Of course we can do that.
This is the project that implements this solution:
http://adldap.sourceforge.net/wiki/doku ... lm_winbind
Re: LDAP authentication
Posted: Thu Apr 22, 2010 2:49 pm
by systems
I want to see if anyone has attempted to implement LDAP authentication or Active Directory authentication through Nagios XI?
I understand Nagios XI currently does not support LDAP/AD authentication, but I have found a web site about Nagios single sign-on using Active Directory.
http://www.itefix.no/i2/node/11683
Has anyone out there follow this procedure on Nagios XI? Can this be done?
Re: LDAP authentication
Posted: Thu Apr 22, 2010 3:20 pm
by mmestnik
Currently Nagios XI uses it's own internal cookie based authentication, so outside plugins wont effect it. The code that would need to be changed is also encrypted, so there is almost no chance anyone would be able to do this on there own.
Authenticating users with LDAP or Active Directory?
Posted: Thu May 13, 2010 2:00 pm
by justin
We would like to be able to let our users reuse their existing Microsoft Domain passwords instead of remember another one for Nagios. Is it possible to have our users authenticate against LDAP or Active Directory instead of the database or where ever the passwords are being stored.
Manually creating the account is preferred, but passing the authentication back to the domain makes more sense for us.
Thanks,
Justin
Re: Authenticating users with LDAP or Active Directory?
Posted: Thu May 13, 2010 2:10 pm
by tonyyarusso
This is not possible yet, but is a frequent request, so definitely something we are looking at for future versions. There is some additional discussion of this in another thread as well,
http://support.nagios.com/forum/viewtopic.php?f=6&t=24
Re: Authenticating users with LDAP or Active Directory?
Posted: Wed May 19, 2010 2:53 pm
by ac25nagios
Thanks. Tony.
Our organization needs LDAP integration too. We plan use LDPA for login authentication. Also, set the restriction to certain group to navigate XI GUI or perform some function. For example, Linux Admin group can only see their own servers and perform scheduleing downtime, and AIX group can do theirs only. some people was allowed to configure services....
We are so closed but there is one thing we can not figure out. Where is the user login information saved? Thanks