Help with insecure login / backend ticket authentication.
Posted: Thu May 28, 2020 2:38 pm
Hello Nagios Support,
Some colleagues of mine are working to integrate OpsGenie with Nagios XI. The XI integration for OpsGenie is written to use the old backend-ticket authentication to perform actions on the Nagios XI server. We're having trouble with this... A couple of examples:
1. Starting at a low level - This example URL works in a web browser, but not when run through a script or simply by curl on the command line:
https://<nagios_server>/nagiosxi/index.php?username=<username>&ticket=<insecure login ticket>
When run in curl or through a script, we always get the message, "Your session has timed out".
2. Going deeper -- OpsGenie integration is trying to execute a command like this in a script:
https://<nagios_server>/nagiosxi/includes/components/nagioscore/ui/trends.php?createimage&host=<hostname>&username=<username>&ticket=<insecure login ticket>
This only works in a web browser - and only if we are logged into Nagios XI (as any user). It will not work if we are not logged in, and will not work on command line. Failures result in the same "Your session has timed out" message.
Are these conditions by chance a bug? Or is it something more likely like browser session cookies not being handed off correctly?
Is there anything we can do to work around these issues?
Thanks,
-marc
Some colleagues of mine are working to integrate OpsGenie with Nagios XI. The XI integration for OpsGenie is written to use the old backend-ticket authentication to perform actions on the Nagios XI server. We're having trouble with this... A couple of examples:
1. Starting at a low level - This example URL works in a web browser, but not when run through a script or simply by curl on the command line:
https://<nagios_server>/nagiosxi/index.php?username=<username>&ticket=<insecure login ticket>
When run in curl or through a script, we always get the message, "Your session has timed out".
2. Going deeper -- OpsGenie integration is trying to execute a command like this in a script:
https://<nagios_server>/nagiosxi/includes/components/nagioscore/ui/trends.php?createimage&host=<hostname>&username=<username>&ticket=<insecure login ticket>
This only works in a web browser - and only if we are logged into Nagios XI (as any user). It will not work if we are not logged in, and will not work on command line. Failures result in the same "Your session has timed out" message.
Are these conditions by chance a bug? Or is it something more likely like browser session cookies not being handed off correctly?
Is there anything we can do to work around these issues?
Thanks,
-marc