Details
-
Bug
-
Resolution: Fixed
-
Major
-
None
-
Professional Edition
-
None
-
Debian with LDAP authentication
All members in observium_user
to grant more acces added to observium_admin or observium_global_read
Description
i added a couple normal users and added them to have access to a whole group. when i did that they logged in and saw no devices. so i tried giving them permissions to individual devices and they still couldn't see anything.
Attachments
Issue Links
- is mentioned by
-
OBS-4097 LDAP user don't see assigned devices
-
- In Review
-
Activity
I tested my own LDAP config and normal user groups and permissions.
All worked fine, I not found any issues. But I not use AD and not tested with it.
Also as I see, you use lowercase 'cn=', 'ou=', 'dc='.. I not sure but AD can be case-sensitive and you should use uppercase 'OU='.
Anyway, this is just troubles with your config, ask in maillist for people who used AD integration.
I didnt think it was relevant to give the full screenshot since i cant get a screenshot that shows the dashboard AND who is signed in since this information is not displayed. I will post in this mailing list and hope they are more trusting that i am correctly authenticating since i am in fact logged in.
The person you need to ask can't see any of these replies. You need to go to the mailing list :>
When providing screenshots you need to provide the entire screen. We can't verify that the usernames match, so for all we know, you're just being incredibly careless 
You are correct i miss read #534. There is no way for these normal users to see any devices
Yes, i believe it is an issue with observium not attaching the permissions at login. The part of the screenshot that was not included is that the user is listed as a "Normal User". so the LDAP authentication is working fine. They are able to log in just not getting the permissions that they were given(cant see devices admin allowed), which is why i think it is a bug. The authentication is working properly. I just didnt know if there is a different way permissions were assigned to ldap users compared to mysql users.
Though, I'm not sure this is actually related to LDAP at all. If the user is able to log in, and Observium allows you to edit settings for the user (which we can't actually verify since you thought it useful to only post 1/3rd of screenshots), it's probably more related to Observium not attaching to permissions to the user at login time, which would be... odd.
This should better be directed to the mailing list where might find someone who has made LDAP work properly.
Neither Mike nor myself use LDAP.
You use LDAP? Well, I never!
BTW, you're much more likely to get a resolution to an issue if you provide the maximum about of information.
Often if people can't see all of the information, they'll be much less likely to reply, this a big thing for support in general. More information will never prevent a resolution, too little information will prevent a resolution every time.
I've just realised there's not actually anywhere in the UI which tells you your username though, so, that's probably something for us to fix, too!
That said, I'm still not sure there's actually a way this can happen, though I don't actually have an LDAP installation to test.
I'll add the username to the UI somewhere, so we can verify that the correct database user account is being used.