Nagios Support Forum

Code: Select all

ScriptAlias /nagios/cgi-bin "/usr/local/nagios/sbin"

<Directory "/usr/local/nagios/sbin">
Options ExecCGI
AllowOverride None
Order allow,deny
Allow from all
AuthBasicProvider ldap
AuthName "Nagios Access"
AuthType Basic
AuthzLDAPAuthoritative Off #Prevent LDAP from endlessly retrying
AuthLDAPBindDN "CN=user,OU=infolder,DC=domain,DC=com" #DN for authentication user used to look up accounts (this account should have read only)
AuthLDAPBindPassword password #Password for above user
AuthLDAPURL ldaps://domain-controller/OU=where-users-are,DC=domain,DC=com?sAMAccountName?sub #The base OU to search for users NOTE: you MAY NOT be able bind to the directory root to search for users when using AD as the directory... this is a rarely encountered but known issue.
Require valid-user
</Directory>

Alias /nagios "/usr/local/nagios/share"

<Directory "/usr/local/nagios/share">
Options None
AllowOverride None
Order allow,deny
Allow from all
AuthBasicProvider ldap
AuthName "Nagios Access"
AuthType Basic
AuthzLDAPAuthoritative Off
AuthLDAPBindDN "CN=user,OU=infolder,DC=domain,DC=com"
AuthLDAPBindPassword password 
AuthLDAPURL ldaps://domain-controller/OU=where-users-are,DC=domain,DC=com?sAMAccountName?sub
Require valid-user
</Directory>

Code: Select all

#!/usr/bin/perl -w

use strict;
use warnings;
use Net::LDAP;

my $adGroup = "ADGroup"
my $adUser = "CN=binduser,OU=directory,DC=domain,DC=com";
my $adPassword = "password";
my $adDomain = "domain.com";
my $adSearchBase = "DC=domain,DC=com";

my $adConnection = Net::LDAP->new($adDomain) or die "$@";
$adConnection->bind($adUser,password => $adPassword);
my $adQueryResults = $adConnection->search( base => $adSearchBase, scope => 'sub', filter => "(sAMAccountName=$adGroup)"

foreach my $adGroupMemberDN ($adQueryResults->entry->get_value('member')) {
                my $adUserQueryResults = $adConnection->search( base => $adSearchBase, scope => 'sub', filter => "(distinguishedName=$adGroupMemberDN)");
                my $adUserEntry = $adUserQueryResults->entry;
                my $userName = $adUserEntry->get_value('sAMAccountName');
}

#
# PSEUDO CODE FROM HERE
#
Open cfi.cfg;

foreach $line (@filecontents) {
    if $line begins with "access_level" AND user is member of AD group with access level AND user does not exist in string add user to string
    push $line to @newArray
}

Write @newArray to cgi.cfg