{"id":2835,"date":"2018-10-30T19:04:02","date_gmt":"2018-10-31T00:04:02","guid":{"rendered":"http:\/\/osric.com\/chris\/accidental-developer\/?p=2835"},"modified":"2018-10-30T19:29:38","modified_gmt":"2018-10-31T00:29:38","slug":"icinga2-role-permissions-filters","status":"publish","type":"post","link":"https:\/\/osric.com\/chris\/accidental-developer\/2018\/10\/icinga2-role-permissions-filters\/","title":{"rendered":"Icinga2 role permissions, filters"},"content":{"rendered":"<p>I have Icinga2 and Icingaweb2 set up for monitoring hosts and services for myself, but I wanted to expand on my current configuration and let web developers manage monitoring for their assets (development and staging hosts and web servers).<\/p>\n<p><code>webdev<\/code> is the name of one of my host groups, defined in my <code>\/etc\/icinga2\/conf.d\/groups.conf<\/code> file:<\/p>\n<pre><code>object HostGroup \"webdev\" {\r\n  display_name = \"Web Development Hosts\"\r\n}<\/code><\/pre>\n<p>The hosts I want developers to be able to monitor are members of the <code>webdev<\/code> host group.<\/p>\n<p>First I created a new role in the web interface under <strong>Configuration &#8212; Authentication &#8212; Roles<\/strong>:<br \/>\n<!--more--><\/p>\n<dl>\n<dt>Role Name:<\/dt>\n<dd>webdev<\/dd>\n<dt>Groups:<\/dt>\n<dd> webdev [this is the name of a group on my LDAP server]<\/dd>\n<dt>Permission Set:<\/dt>\n<dd> Allow everything (*)<\/dd>\n<dt>monitoring\/filter\/objects:<\/dt>\n<dd> &#8220;webdev&#8221;<\/dd>\n<\/dl>\n<p>This created the role without any errors. However, when I logged in as a member of the webdev group, I received the following error message:<\/p>\n<pre><code>Service Problems\r\nCannot apply restriction monitoring\/filter\/objects using the filter webdev. You can only use the following columns: instance_name, host_name, hostgroup_name, service_description, servicegroup_name, _(host|service)_&lt;customvar-name&gt;<\/code><\/pre>\n<p>I needed to specify a key-value pair for the monitoring\/filter\/objects:<\/p>\n<pre><code>hostgroup_name=webdev<\/code><\/pre>\n<p>You can include multiple host groups by including a logical OR:<\/p>\n<pre><code>(hostgroup_name=webdev||hostgroup_name=webprod)<\/code><\/pre>\n<p>Once I confirmed that worked, I further restricted the Permission Set to a more limited set of options:<\/p>\n<ul>\n<li>Allow access to module monitoring (module\/monitoring)<\/li>\n<li>Allow all commands (monitoring\/command\/*)<\/li>\n<\/ul>\n<p>A user in the webdev role now has access to everything I expected <em>except<\/em> contacts (<strong>Overview &#8212; Contacts<\/strong>). The Contacts page produces a long and unfriendly error message that begins with:<\/p>\n<p><code>SQLSTATE[42S22]: Column not found: 1054 Unknown column 'ho.object_id' in 'on clause'<\/code><\/p>\n<p>That&#8217;s a known bug, and currently an issue filed on the icingaweb2 GitHub repository: <a href=\"https:\/\/github.com\/Icinga\/icingaweb2\/issues\/3564\">Non-admin overview Contact gives SQL error<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>I had previously set up Icinga 2 and Icinga Web 2 for my own infrastructure monitoring needs. I wanted to expand this to allow other users to have a limited view into the monitoring system and see just their own assets (hosts and services). The biggest hurdle for me was determining the correct filter syntax. This post describes the steps I took to configure a role in Icinga 2 for limited access to the monitoring system.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[484],"tags":[495],"class_list":["post-2835","post","type-post","status-publish","format-standard","hentry","category-monitoring","tag-icinga2"],"_links":{"self":[{"href":"https:\/\/osric.com\/chris\/accidental-developer\/wp-json\/wp\/v2\/posts\/2835","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/osric.com\/chris\/accidental-developer\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/osric.com\/chris\/accidental-developer\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/osric.com\/chris\/accidental-developer\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/osric.com\/chris\/accidental-developer\/wp-json\/wp\/v2\/comments?post=2835"}],"version-history":[{"count":6,"href":"https:\/\/osric.com\/chris\/accidental-developer\/wp-json\/wp\/v2\/posts\/2835\/revisions"}],"predecessor-version":[{"id":2852,"href":"https:\/\/osric.com\/chris\/accidental-developer\/wp-json\/wp\/v2\/posts\/2835\/revisions\/2852"}],"wp:attachment":[{"href":"https:\/\/osric.com\/chris\/accidental-developer\/wp-json\/wp\/v2\/media?parent=2835"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/osric.com\/chris\/accidental-developer\/wp-json\/wp\/v2\/categories?post=2835"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/osric.com\/chris\/accidental-developer\/wp-json\/wp\/v2\/tags?post=2835"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}