rivad
(Dominik)
December 20, 2023, 3:07pm
2
This is why I keep icingaweb2 roles and teams in Director synchronized.
In my case the answer is: every Host and Service you can see, can send you messages.
There are two locations where you may need to filter groups.
allow only a selection of AD users to login on Icingaweb2. This is via LDAP filter in the user backend
I guess some thing like:
"(&(objectClass=user)(memberof:1.2.840.113556.1.4.1941:=CN=icingaweb2,OU=Permission,OU=Groups,DC=example,DC=com))" could work as it resolves also the ones in subgroups. I use Apache Directory Studio to figure such stuff out.
in the Icingaweb2 roles, you need to define the groups and users that get the role…