Purpose
State the different authentication methods available for OMK applications
Authentication Methods
OMK authentication methods are configured in /usr/local/omk/conf/opCommon.nmis inside the authentication hash. This entire file is a perl hash, so be mindful of syntax. After editing this file a 'perl -c opCommon.nmis' will verify if the syntax is correct. For authentication method changes to take effect the omkd service will need to be restarted. Here's an example of the authentication hash inside opCommon.nmis. Remember that statements preceded by the '#' sign are 'commented out' and will not be evaluated.
Note: The limit for different auth_method options is 3.
'authentication' => {
'auth_htpasswd_file' => '<omk_conf>/users.dat',
'auth_htpasswd_encrypt' => 'crypt',
'auth_method_1' => 'htpasswd',
'auth_method_2' => '',
'auth_method_3' => '',
'auth_login_motd' => 'Authentication required: default credentials are nmis/nm1888',
'auth_crowd_server' => '',
'auth_crowd_user' => '',
'auth_crowd_password' => '',
'auth_sso_domain' => '',
'auth_expire_seconds' => '3600',
'auth_lockout_after' => 0,
#'auth_ms_ldap_attr' => 'sAMAccountName',
#'auth_ms_ldap_base' => 'CN=Users,DC=your_domain,DC=com',
#'auth_ms_ldap_group' => 'CN=Users,DC=your_domain,DC=com',
#'auth_ms_ldap_debug' => 'false',
#'auth_ms_ldap_dn_acc' => 'CN=Administrator,CN=Users,DC=your_domain,DC=com',
#'auth_ms_ldap_dn_psw' => 'your_administrator_password',
#'auth_ms_ldap_server' => 'your.ip.address.here'
},
The following table lists OMK configuration options and the type of authentication which it works with.
| Method | Description |
|---|---|
| ldap | OMK will use the configured LDAP server to perform authentication Config: |
| ldaps (secure) | OMK will use the configured LDAP server to perform authentication auth_ldaps_server => 'host[:port]' |
ms-ldap | OMK will use the configured Microsoft Active Directory (LDAP) server to perform authentication Config: |
| ms-ldaps (secure) | OMK will use the configured Microsoft Active Directory (LDAP) server to perform authentication Config: |
| radius | OMK will use the configured radius server (Cisco ACS or Steel Belted Radius for example) Config: |
| tacacs | OMK will use the configured Tacacs+ server (Cisco ACS for example) Config: |
| htpasswd | OMK will use the users defined in the OMK Users file, by default /usr/local/omk/conf/users.dat. Very often /usr/local/omk/conf/users.dat is a symlink pointing to /usr/local/nmis8/conf/users.dat. The htpasswd user file may be changed by altering the auth_htpasswd_file key in the opCommon.nmis authentication hash. |
| token | Delegated authentication by token as described here: Delegated Authentication |
Configuration of the External Authentications
In the OMK configuration you can configure multiple methods which are used for auth failure, so if ms-ldap fails, it will fail back to htpasswd for example. This means if you set auth_method_1 to be ldap and auth_method_2 to be htpasswd, and login with the default NMIS credentials (and you have not changed the password), the authentication for LDAP will fail, and then authentication with the users.dat will succeed and the user will be logged in.
It is important to change your default passwords if you expect any level of security.
Authentication methods are evaluated in sequence. The first method that returns successful authentication terminates the authentication process. If a method returns an unsuccessful authentication, the process does not terminate, the next authentication method will be evaluated. Consider the following scenario when provisioning authentication for OMK applications.
- OMK First authentication method: LDAP
- OMK Second authentication method: htpasswd
- User Bob has an LDAP account and has a user in the htpasswd users file.
- User Bob leaves the company
- The IT department removes Bob's LDAP account assuming he will no longer be able to access corporate systems.
- Bob will still be able to access OMK applications because there is a user Bob in the htpasswd user file.
NMIS9 Notes
From NMIS9, changes will instead need to be made to the opCommon.json configuration file (located in /usr/local/omk/conf/). As we are using .json format files instead of .nmis, the format of the attributes to use is slightly different. See below for an example using TACACS:
"auth_tacacs_server" : "host:port", "auth_tacacs_secret" : "secret",
An example of integrating your ms-ldap setup with modules such as opConfig, opEvents, opCharts etc. is below. Ensure you have also included ms-ldap as in one of the auth_methods:
"authentication" : {
...
"auth_ms_ldap_server" : "IP_ADDRESS_OF_YOUR_MS_LDAP_SERVER", #eg. 192.168.1.22
"auth_ms_ldap_dn_acc" : "svc_omk_admin", #you should only need to use the username of the user here, but if this is not successful, you can use username@domain as well.
"auth_ms_ldap_dn_psw" : "password_of_the_dn_acc_above",
"auth_ms_ldap_attr" : "sAMAccountName",
"auth_ms_ldap_base" : "OU=Network Admins,DC=contoso,DC=local",
...
},
Once you have saved the updated opCommon.json configuration, you will then need to restart the omkd daemon.
Troubleshooting
If you are experiencing issues with configuring your external authentication method, extra debug can be enabled to assist.
Depending on the authentication method you are using, the following two attributes can be added to your opCommon.json. This should cover most, if not all of our authentication methods to debug.
"authentication" : {
...
"auth_debug" : 1,
"auth_ldap_debug" : "true"
...
},
Save the file once you have added these two extra lines and restart omkd. Repeat the authentication process again, then review auth.log (located in the /usr/local/omk/log directory) and troubleshoot.