LDAP Integration
Introduction
The authentication system is handled by authentication drivers. Each driver handles authentication of the user, and resolution of the group memberships for the given user. The groups is then mapped to permissions by the authorization layer, which is described later.
An auth driver can either use a local storage of users (Driver Default), rely on apache authentication (Driver apache), or use an external system for managing users (Driver LDAP).
The authentication system is configured through the configuration, using the
Auth Modules option under configuration.

The configuration for the authentication system is stored in the “auth” configuration file, located in /etc/op5/auth.yml
Default
For local users, the default driver can be used. This enables a local store of users at the op5 Monitor server. It is recommended that you always keep this driver configured with an admin account as a fallback if the system is primarily using LDAP.
When the Default driver is enabled, a configuration interface, named Local Users appears in op5 configuration.
In the local users page, each user has a real name, a password can be set, and group membership can be controlled. Groups needs to be created in advance. See
Group rightsThis driver stores the users in the auth_users configuration file, located in /etc/op5/auth_users.yml.
LDAP and Active Directory
For central user management, an LDAP server can be used, like Microsoft Active Directory or OpenLDAP. When used, op5 Monitor verifies the user with the LDAP server lookup the group membership of the users in the directory.
Before we start
This documentation assumes that you have:
•Administrator access to the domain
•Basic knowledge about LDAP structure
Prepare your domain
In op5 Monitor, permissions is handled by groups. Make sure you have one group available for each role in the system.
If the domain doesn’t allow to bind anonymously to resolve group memberships or find users, a service account must be added. This account needs to have read access to resolve group membership and search for users in the system.
Connection parameters
Server
Address to the LDAP server, or servers. Can be a space separated list of addresses. Addresses are added for redundancy. Servers will be used in that order.
Port
TCP port to connect to. Leave blank for default. (389 for no encryption/start-tls, 636 for ssl)
Encryption
Which type of encryption to use for connection between op5 Monitor to the LDAP server. (none, start_tls or ssl). Make sure to have a valid ssl certificate for the LDAP server, and php recognizes it.
Bind DN
Distinguished name (or user principal name for active directory, which is username@domain) of the service account, created under “Prepare your domain” above, or empty to bind anonymously.
Bind secret
Password for the service user.
For security reasons, this can also be a path to a filename containing the password. To use this feature, enter file:/path/to/secret/file
It is also possible to keep the password in a separate config file, when multiple LDAP-connections is used. In this case, enter “config:configname”, which will use config file /etc/op5/configname.yml. The config file should then contain one line per driver: “driver name: secret”
Base DN
The distinguished name for the root of the directory to access. This is usually the DN for the domain, for example: DC=example,DC=com
User base DN
The base DN to search for users. This is an absolute DN, and not relative to Base DN. In almost all cases, use the same value as Base DN here.
User filter
A LDAP filter used to filter out user objects. Usually this is a filter for objectClass. For Active Directory “(objectClass=user)” should work.
Group Base DN
The base DN to search for groups. This is an absolute DN, and not relative to Base DN. In almost all cases, use the same value as Base DN here.
Group filter
A LDAP filter used to filter out group objects. Usually this is a filter for objectClass. For Active Directory “(objectClass=group)” should work.
Groupkey
The name of the attribute identifying the group. For Active Directory, “cn” should work.
Group Recursive
If groups can be nested, so that a group can be member of another group. This is possible in Active Directory, and should there be active.
With this unchecked, only members of that group directly will be treated as members of the group. If this is the case for systems which supports nested groups. This checkbox can be unchecked for performance reasons.
UPN Suffix
When binding with UPN (user principal name), this is the suffix to use after @, which is the domain name. For example, if the UPN of a user is “username@example.com”, the UPN suffix is “example.com”.
Userkey
The key to select the username of a user in the system. Older versions of Active Directory uses sAMAccountName. But in later versions, use userPrincipalName
Userkey is UPN
Check this if the userkey is a UPN. In that case, the domain part of the userkey will be ignored. Check this if you are using Active Directory, and userPrincipalName as userkey.
Userkey realname
The name of the attribute in the user object describing the real name of the user. For active Directory, and most other LDAP systems, “cn” should work. This is used to nicely display the username of the logged in user.
Userkey email
The name of the attribute in the user object containing the the email address. For active directory, and many other systems, “mail” should work.
Memberkey
The name of the attribute in a group, which contains the reference to it’s members.
When using LDAP with posix extensions, this should be “memberUid”. When group is of class “groupOfUniqueNames”, this should be “uniqueMember”. For Active Directory, “member” should work.
Memberkey is DN
Check this box if Memberkey is defines the entire DN of the member user or group, not only it’s name. For Active Directory, this is true. In a posix system, this is false.
Bind with UPN
If binding to the LDAP server should be done with the user principal name instead of the DN of the user.
For Active Directory, this is true. For all other systems, this is false.
When binding with UPN, the system constructs a UPN from the username and UPN suffix, and tries to bind with the constructed UPN and given password. If bind succeeds, it resolves the groups.
When binding with DN, the system tries to bind with “Bind DN” and “Bind Secret” to look in the directory for the user. If the user is found, it tries to rebind with the user DN and password given, and if that succeeds, the group membership is resolved.
Protocol version
The LDAP protocol version to use. Almost everyone will keep this at 3.
Example configuration for Active Directory
Server: ldap.example.com
Port:
Encryption: none
Bind DN: service_op5@example.com
Bind Secret: file:/etc/op5/ldap_secret
Base DN: DC=example,DC=com
User Base DN: DC=example,DC=com
User filter: (objectClass=user)
Group Base DN: DC=example,DC=com
Group filter: (objectClass=group)
Groupkey: cn
Group Recursive: yes
UPN Suffix: example.com
Userkey: userPrincipalName
Userkey is UPN: yes
Userkey realname: cn
Userkey email: mail
Memberkey: member
Memberkey is DN: yes
Bind with UPN: yes
Protocol version: 3
Test your connection
To test if the system can bind using “Bind DN” and “Bind Secret”, go to Assign Group Rights page in op5 configuration. A column has appeared for the driver, and the corresponding group parameters is correctly set.
If a group is successfully resolved, the corresponding cell is turned green. If it is determined that the group doesn’t exist in the LDAP domain, the cell is red. In either way, a successful connection has been established.
If the connection failed, all the cells are gray.
Apache
A system can also rely on apache to authenticate the user. In this case, it is up to the user to protect the /monitor path with access in the apache web server, either by an .htaccess file or in the apache configuration.
The apache driver makes it possible to use apache modules for single sign-on authentication solutions, or other systems, like mysql or kerberos.
The driver gets the authenticated username from apache, and adds the group apache_auth_user to all users logged in.
For the apache login to work the Auto Login must be enabled.
Go to
Configure ->
Auth Modules and enable the
Auto Login chcekbox.

| Note: The apache auth interface doesn’t handle groups. Therefore it is impossible to get group membership out of the apache authentication, so each user is only member of two groups: user_<username> and apache_auth_user. When using central user management, the LDAP interface is therefore recommended where possible. |
Authorization
Group rights
Authorizations are only set on a per group(s). When an authorization point is hovered a tooltip will appear explaining what the setting does and the corresponding group and setting will be highlighted

Expand/Contract authorization categories
The authorization categories are contracted by default. You can either choose to expand or contract all categories simultaneously by clicking the Expand/Contract all buttons

or expand or contract them individually by clicking the +/- sign underneath each category.

Select/Deselect all rights
To select or de-select all the rights in a group of rights, for example “Host” check the checkbox below the group of rights that you would like to add or remove.

The minus sign (-) in the checkbox means that the group of rights is partially selected. Some rights in the group are checked.

Lookup user
You can find out which groups a user is a member of by entering a username in the Lookup user text box and clicking the Lookup button.

The groups that the user is a member will be highlighted and the authentication driver that they belong to will be indicated with an
X.
You will also get a list of additional groups the user is a member of underneath the Lookup user text box. An empty search string will hide the list and remove the highlights.
Filter groups
By adding a filter text in the Filter groups text box and clicking Filter groups you can set a filter on the visible groups.

Wildcard characters are neither supported nor needed. For example the filter strings “ad”, “a” and “min” will all match a group called “admins”.

An empty filter string will reset the filter.
Add, delete, rename groups
Renaming groups is done by typing a new name in the group name text box.
In the GUI you can create one new group each submit by filling the blank text box with the group name you want to create.
To add a LDAP or AD group type in the name of the group as it is named in your LDAP or AD.
Deletion of groups is done by removing the group name from the text box and leaving it blank when submitting your changes.
Configuration files used by authorization
The file /etc/op5/auth_groups.yml consists of all defined groups and their respective authorization points.
The GUI does not have to be used to edit authorization but we recommend that you use it to avoid syntax problems.
Authorization points
System Information
Gives the user access to the system/process information.
Configuration Information
Gives the user access to view and change configuration
System Commands
Gives the user access to issuing commands in the web gui.
Api Config
Gives the user access to the HTTP-API configuration interface.
Api Status
Gives the user access to the HTTP-API status interface.
Host Add Delete
Gives the user right to add and delete hosts.
Host View All
Gives the user right to view all hosts.
Host View Contact
Gives the user right to view hosts that he/she is contact for.
Host Edit All
Gives the user right to edit all existing hosts.
Host Edit Contact
Gives the user right to edit hosts that he/she is contact for.
Test This Host
Gives the user right to test the host that is being configured.
Service Add Delete
Gives the user right to add and delete services.
Service View All
Gives the user right to view all services.
Service View Contact
Gives the user right to view services that he/she is contact for.
Service Edit All
Gives the user right to edit all existing services.
Service Edit Contact
Gives the user right to edit services that he/she is contact for.
Test This Service
Gives the user right to test the service that is being configured.
Hostgroup Add Delete
Gives the user right to add and delete hostgroups.
Hostgroup View All
Gives the user right to view all hostgroups.
Hostgroup View Contact
Gives the user right to view hostgroups that he/she is contact for.
Hostgroup Edit All
Gives the user right to edit all existing hostgroups.
Hostgroup Edit Contact
Gives the user right to edit hostgroups that he/she is contact for.
Servicegroup Add Delete
Gives the user right to add and delete servicegroups.
Servicegroup View Al
Gives the user right to view all servicegroups.
Servicegroup View Contact
Gives the user right to view servicegroups that he/she is contact for.
Servicegroup Edit All
Gives the user right to edit all servicegroups.
Servicegroup Edit Contact
Gives the user right to edit servicegroups that he/she is contact for.
Hostdependency Add Delete
Gives the user right to add and delete hostdependencies.
Hostdependency View All
Gives the user right to view hostdependencies.
Hostdependency Edit All
Gives the user right to edit hostdependencies.
Servicedependency Add Delete
Gives the user right to add and delete servicedependencies.
Servicedependency View All
Gives the user right to view servicedependencies.
Servicedependency Edit All
Gives the user right to edit servicedependencies.
Hostescalation Add Delete
Gives the user right to add and delete hostescalations.
Hostescalation View All
Gives the user right to view hostescalations.
Hostescalation Edit All
Gives the user tight to edit hostescalations.
Serviceescalation Add Delete
Gives the user right to add and delete serviceescalations.
Serviceescalation View All
Gives the user right to view serviceescalations.
Serviceescalation Edit All
Gives the user right to edit serviceescalations.
Contact Add Delete
Gives the user right to add and delete contacts.
Contact View All
Gives the user right to view contacts.
Contact Edit All
Gives the user right to edit contacts.
Contactgroup Add Delete
Gives the user right to add and delete contactgrops.
Contactgroup View All
Gives the user right to view contactgroups.
Contactgroup Edit All
Gives the user right to edit contactgroups.
Timeperiod Add Delete
Gives the user right to add and delete timeperiods.
Timeperiod View All
Gives the user right to view timeperiods.
Timeperiod Edit All
Gives the user right to edit timeperiods.
Command Add Delete
Gives the user right to add and delete commands.
Command View All
Gives the user right to view commands.
Command Edit All
Gives the user right to edit commands.
Test This Command
Gives the user right to execute commands.
Template
Gives the user right to view and change templates.
Wiki
Gives the user right to view, create and change docuwiki pages for objects he/she is authorized to see.
Wiki Admin
Gives the user right to access the docuwiki admin panel.
File
Gives the user right to change file in which an object is stored.
Access Rights
Gives the user right to edit access rights.
PNP
Gives the user right to access graphs.
Saved Filters Global
Gives the user right to create and delete global filters for listviews.
Export
Gives the user right to export it's own configuration.
Host Template View All
Gives the user right to view host templates.
Host Template Edit All
Gives the user right to edit host templates.
Host Template Add Delete
Gives the user right to add and delete host templates.
Service Template View All
Gives the user right to view service templates.
Service Template Edit All
Gives the user right to edit service templates.
Service Template Add Delete
Gives the user right to add and delete service templates.
Contact Template View All
Gives the user right to view contact templates.
Contact Template Edit All
Gives the user right to edit contact templates.
Contact Template Add Delete
Gives the user right to add and delete contact templates.
Configuration All
Gives the user right to export and import all configuration.
Nagvis Add Delete
Global permission to add and delete all nagvis maps.
Nagvis View
Global permission to view all nagvis maps.
Nagvis Edit
Global permission to edit all nagvis maps.
Nagvis Admin
Get full permission for nagvis, including global configuration