Icinga2 permissions for all LDAP users

Question

I have a Icinga2 running with Active Directory as authentication backend and Icinga Web 2 as frontend.

The frontend permissions can be configured using the roles.ini in Icingaweb2's config folder. This is what I have in there:

# roles.ini

[Users]
users = "*"
permissions = "module/monitoring"

As you can see, I want to give all authenticated users access to the monitoring module. I have no group, which contains all users so I cannot use a group for that.

This does not work. How is the correct syntax to give the permission to all users?

(Of course, using existing user names or group names does work, backend configuration therefore is correct.) Thank you very much in advance!

Since the roles are bound to users/usergroups I would go that route of adding new users to a default group by default. Similar to what's described in the documentation: https://github.com/Icinga/icingaweb2/blob/master/doc/06-Security.md#roles In case you may convince the developers by adding a feature request for wildcard user matches - hop onto dev.icinga.org :) — dnsmichi, Aug 10 '16 at 17:37
I have the same problem and no solution so far. Auth via Apache+LDAP and than "no permission" because Icingaweb2 can not handle it. — Michael, Dec 08 '16 at 14:02

score 0 · Accepted Answer · answered Jul 25 '18 at 13:16

This feature was implemented in IcingaWeb2 version 2.5, see https://github.com/Icinga/icingaweb2/pull/3096. It's a very simple patch against AdmissionLoader.php, which you can also apply separately by hand:

commit f495b390da6eb257ca101889deb70ccc22bb99c7
Author: Eric Lippmann <eric.lippmann@icinga.com>
Date:   Thu Nov 16 12:01:06 2017 +0100

    Apply role to all users if the role is defined with users=*

    If the users directive contains at least one single asterisk, the role is applied to all users.
    So, this supports roles which define users=username, ..., * and users=*

    refs #3095

diff --git a/library/Icinga/Authentication/AdmissionLoader.php b/library/Icinga/Authentication/AdmissionLoader.php
index 0a80be127..8ee43dbfb 100644
--- a/library/Icinga/Authentication/AdmissionLoader.php
+++ b/library/Icinga/Authentication/AdmissionLoader.php
@@ -28,6 +28,9 @@ class AdmissionLoader
         $username = strtolower($username);
         if (! empty($section->users)) {
             $users = array_map('strtolower', StringHelper::trimSplit($section->users));
+            if (in_array('*', $users)) {
+                return true;
+            }
             if (in_array($username, $users)) {
                 return true;
             }

Icinga2 permissions for all LDAP users

1 Answers1