Defining Active Directory ACL Groups

ShaunG

Good Day,

I need to define ACL's based on AD Group Memberships. How do I define these Groups in lpar2rrd.cfg file :

# *** Uncomment it only if you intend to use it, more on http://www.lpar2rrd.com/ldap.htm ***

# Default group for LPAR2RRD ACL administration

ACL_ADMIN_GROUP=UG-SPFBEL01A-lpar2rrdAdmins

# Apache variable name containing list of authorized user groups

#ACL_GRPLIST_VARNAME=AUTHENTICATE_MEMBEROF

I am assuming this must get defined, but find no examples :

#ACL_GRPLIST_VARNAME=AUTHENTICATE_MEMBEROF

Regards

Pavel

Hi,

the best is using Xormon application (it is an application front-end above of lpar2rrd & stor2rrd data) especially when you intend to use AD. It can be easilly attach to AD.

ShaunG

Morning,

Unfortunately in our environment we are using the 'free' LPAR2RRD.

Regards

Pavel

install Xormon and attach it to runnning lpar2rrd. It uses lpar2rrd collected data.

Xormon itrself does not collect data, it is just an application layer.

It is also free

https://xormon.com/download.php

https://xormon.com/install-xormon.php

ShaunG

Thanks ...

Regards

ShaunG

Good Day,

Under the LDAP section for Xormon, I see no fields for username / password to connect to LDAP sources or am I missing something ?

Regards

TomasJetelina

each user connects by theirs own credentials

https://xormon.com/active-directory.php

ShaunG

Good Day,

Our current setup is that we have an Admin Group and a User Group. A request has been logged to give a user limited access to certain servers so we have to now accomodate for that.

Pavel Recommended Xormon. I have it installed but to connect to the LDAP Server we need to provide credentials. No anonymous access. That is what I am querying atm.

Regards

lmelcher

https://forum.xorux.com/discussion/comment/5923#Comment_5923

ShaunG, each user authenticates themselves to the LDAP server. So there is no need to configure the binddn and password. To get the initial list of AD groups when running the test, just make sure the AD user you use has the privs to scan the entire LDAP tree you want to pull your group list from.

ShaunG

Thanks ...