Microsoft Active Directory is used to share user list, provide single sign on and other central features in large Microsoft based workstation and server networks.
Before configuring op5 Monitor, we need to set up a user op5 Monitor can use to read authentication data from Active Directory, and an Admin group for the op5 Monitor itself.
Now make sure you have your configuration files like this:/opt/op5sys/etc/ldapserver:
LDAP_BASE=dc=webinar,dc=op5 LDAP_BIND_DN=op5auth@webinar.op5 LDAP_GROUP=ou=op5_Operators,dc=webinar,dc=op5
LDAP_IS_AD=1
LDAP_SERVER=172.27.86.97
LDAP_UPNSUFFIX=webinar.op5
LDAP_USERKEY=uid
LDAP_USERS=ou=op5_Operators,dc=webinar,dc=op5
/opt/op5sys/etc/ldaprights.cfg:
authorized_for_system_information admins,viewers
authorized_for_configuration_information admins,viewers
authorized_for_system_commands admins
authorized_for_all_services admins,viewers
authorized_for_all_hosts admins,viewers
authorized_for_all_service_commands admins
authorized_for_all_host_commands admins
/etc/httpd/conf.d/op5ldapauth.conf:<Location /monitor.old/>
AuthzLDAPServer 172.27.86.97
AuthzLDAPUserBase ou=op5_Operators,dc=webinar,dc=op5
AuthzLDAPGroupBase ou=op5_Operators,dc=webinar,dc=op5
AuthzLDAPUserKey sAMAccountName
AuthzLDAPBindDN op5auth@webinar.op5
AuthzLDAPBindPassword p4ssw0rd.
require valid-user
AuthzLDAPUserScope subtree
AuthType basic
AuthzLDAPMethod ldap
AuthName "op5 Monitor Access"
</Location>
Now, the "LDAP_USERS" variable in /opt/op5sys/etc/ldapserver controls where update-users.php will find users, and the "LDAP_GROUP" controls where the script will find the groups you have defined in /opt/op5sys/etc/ldaprights.cfg.
LDAP_GROUP=ou=op5_Operators,dc=webinar,dc=op5LDAP_USERS=ou=op5_Operators,dc=webinar,dc=op5
The script will only sync over users that exist under the op5_Operators OU, belonging to any group defined /opt/op5sys/etc/ldaprights.cfg under that OU, so using the above example structure, the cgi.cfg will be populated like this:
authorized_for_system_information=op5admin,op5viewerauthorized_for_configuration_information=op5admin,op5viewer
authorized_for_system_commands=op5admin
authorized_for_all_services=op5admin,op5viewer
authorized_for_all_hosts=op5admin,op5viewer
authorized_for_all_service_commands=op5admin
authorized_for_all_host_commands=op5admin
See that despite the user kalle.kula being a member of admins, he does not get included, because the script doesn't look for users in the Users Container, only in the op5_Operators OU.
Now, say that we want to have all our users in the User Container, and just keep two groups in the op5_Operators OU, we can change the
LDAP_USERS variable in
/opt/op5sys/etc/ldaprights.cfg to:
As you see, now the users from the op5_Operators OU don't get included, despite being members of the correct groups, because we told the script to look for users in the Users container instead.
As we only want to change the authentication method we need to remove everything that we do not want to change. This is important as otherwise new updates might not be implemented.
Also keep the firtst row "<?php defined('SYSPATH
') OR die(
'No direct access allowed.
');", this is used for security reasons.