Nagios Support Forum

I am attempting to set up Multi-Tenancy in Nagios XI 2014R2.7. This server is a Red Hat Enterprise Linux 6.6. Before you ask, I have read both the Multi-Tenancy and Understanding User Rights documents.

The problem is that after configuring everything and logging in as the user and attempting to use CCM, the CCM login box appears. After entering the user's password, it reappears after a couple of seconds.

I have the system configured to not require a separate CCM login and any user configured as "admin" in the user setup does not have to log into CCM again. I could live with the additional login requirement, but it doesn't seem to want to accept the user credentials.

I should note that I copied the PostgreSQL xi_users and xi_metadata from one server to this server using suggested methods from the forum (and creating copies of the original tables). We are also using the LDAP authentication, but this user is no being authenticated in that manner. Nagios itself seems to be working.

Following are more details (if needed) on what I'm trying to accomplish and what I have done so far:

I want to create a configuration where a user may do the following:

- See host and service status/alerts (info) for a specific group of hosts
- Create, modify, and delete service checks for that same group of hosts
- Create new hosts and/or services that they (and other members of the contact group) may see and if permitted modify
- We do not want to use any of the notification functionality of Nagios XI because we have other mechanisms for this.

I have done the following:

- Created a contact group (linux_contacts).
- Created a contact (linux_admin)
- Enabled notification for contact
- Assigned the contact group to two hosts (linux_1 and linux_2)
- Assigned user/contact view only privileges

Logging in as user, they can now only see the servers associated with their contact group, which is the expected behavior.

Modify user privileges to allow configuration changes and they can still only see the hosts their contact group is associated with, but the user cannot log into CCM.


I

mp4783 wrote:I want to create a configuration where a user may do the following:

- See host and service status/alerts (info) for a specific group of hosts
- Create, modify, and delete service checks for that same group of hosts
- Create new hosts and/or services that they (and other members of the contact group) may see and if permitted modify
- We do not want to use any of the notification functionality of Nagios XI because we have other mechanisms for this.

These are trivial
This isn't achievable in the current version of CCM, unless of course "that same group" is always all hosts/services. There is no granularity within CCM regarding what users are able to see/modify. There is an existing feature request to tie in the authorization scheme from XI into CCM, but it's not yet arrived.
This is doable, bearing in mind the earlier mentioned limitation that no CCM users can be masked from any CCM configuration. It's all or naught.

The doable component of multi-tenancy is documented here:
https://assets.nagios.com/downloads/nag ... ios-XI.pdf

Thank you for that quick and honest response. It's disappointing, but at least I know what my limitations are.

You may lock this thread.