Most of the customers in which I install the monitoring server have an Active Directory based organization. As such, the best mechanism for authenticating users onto the web pages of the monitoring server is to check that they are valid members of an active directory domain. Authorization to certain specific pages of the monitoring server can then be authorized through group membership.
isADGroupMember.pm is a Perl Module designed to authorize a user through
Active Directory group membership. It performs a recursive group lookup to ensure the user
is somewhere in the hierarchy. It returns a 1 if the user is found in a group, and 0 if no
match is found.
You'll need to update four search parameters at the top of the module in order to work
with your Active Directory Organization. There is a base search path to act as the root of
the search. A user name and password are required for gaining access to Active Directory.
This will require appropriate rights to perform it search. There is a bind address used for
connecting to a global catalog server, which can be an ip address or a fqdn.
The user name will be a SAMAccount formatted name. The same for the group name. Each
are expanded out to their respective DistinguishedNames, which are then used for matching
purposes.
The AuthNTLM module can be used for automatically supplying the user name used
in the lookup. In the solution I'm building, AuthNTLM will take the user name it
automatically obtained from the browser session and place it into a session record in a
database. Mason's autohandler will then pull out the username when it pulls session
information and then use isADGroupMember to authorize access to any given web page.
