Index: nagios-3.2.1/configure
===================================================================
--- nagios-3.2.1/configure	(revision 176)
+++ nagios-3.2.1/configure	(revision 273)
@@ -9186,6 +9186,7 @@
 
 perl subst sample-config/nagios.cfg
 perl subst sample-config/cgi.cfg
+perl subst sample-config/cgiauth.cfg
 perl subst sample-config/resource.cfg
 perl subst sample-config/httpd.conf
 perl subst sample-config/mrtg.cfg
Index: nagios-3.2.1/Makefile.in
===================================================================
--- nagios-3.2.1/Makefile.in	(revision 176)
+++ nagios-3.2.1/Makefile.in	(revision 273)
@@ -243,6 +243,7 @@
 install-config:
 	$(INSTALL) -m 775 $(INSTALL_OPTS) -d $(DESTDIR)$(CFGDIR)
 	$(INSTALL) -m 775 $(INSTALL_OPTS) -d $(DESTDIR)$(CFGDIR)/objects
+	$(INSTALL) -b -m 664 $(INSTALL_OPTS) sample-config/cgiauth.cfg $(DESTDIR)$(CFGDIR)/cgiauth.cfg
 	$(INSTALL) -b -m 664 $(INSTALL_OPTS) sample-config/nagios.cfg $(DESTDIR)$(CFGDIR)/nagios.cfg
 	$(INSTALL) -b -m 664 $(INSTALL_OPTS) sample-config/cgi.cfg $(DESTDIR)$(CFGDIR)/cgi.cfg
 	$(INSTALL) -b -m 660 $(INSTALL_OPTS) sample-config/resource.cfg $(DESTDIR)$(CFGDIR)/resource.cfg
Index: nagios-3.2.1/cgi/cgiauth.c
===================================================================
--- nagios-3.2.1/cgi/cgiauth.c	(revision 176)
+++ nagios-3.2.1/cgi/cgiauth.c	(revision 273)
@@ -37,8 +37,98 @@
 extern int             use_authentication;
 extern int             use_ssl_authentication;
 
+int set_authz_permissions(char* permission, authdata* authinfo) {
+	if (strcmp(permission, "r") == 0) { /* only read permissions */
+		authinfo->authorized_for_read_only = TRUE;
+		authinfo->authorized_for_system_information=TRUE;
+		authinfo->authorized_for_configuration_information=TRUE;
+		authinfo->authorized_for_system_commands=FALSE;
+		authinfo->authorized_for_all_service_commands=FALSE;
+		authinfo->authorized_for_all_host_commands=FALSE;
+	} /* read + write permissions */
+	else if (strcmp(permission, "w") == 0) {
+		authinfo->authorized_for_read_only=FALSE;
+		authinfo->authorized_for_system_information=TRUE;
+		authinfo->authorized_for_system_commands=TRUE;
+		authinfo->authorized_for_configuration_information=TRUE;
+		authinfo->authorized_for_all_service_commands=TRUE;
+		authinfo->authorized_for_all_host_commands=TRUE;
+	}
+	return 0;
+}
 
+/* parsing authorization configuration file */
+int parse_authorization_config_file(char* filename, authdata* authinfo){
+	mmapfile *thefile;
+	char *input=NULL;
+	char *temp_ptr;
+	char *temp_rule;
+	char *role;
+	char *roles;
+	char *roles_tmp;
 
+	/* Attribute based authorization's environment variable */
+	if(getenv("entitlement") == NULL) {
+		printf("<P><DIV CLASS='errorMessage'>Authorization information: entitlement variable is empty</DIV></P>");
+		return -1;
+	}
+
+	roles=getenv("entitlement");
+	roles_tmp=(char *)malloc(strlen(roles)+1);
+
+	/* read in authorization config file */
+	if ((thefile=mmap_fopen(filename))!=NULL) {
+
+		while(1) {
+			char test_char[2];
+			int role_match=0;
+			/* read the next line */
+			if((input=mmap_fgets_multiline(thefile))==NULL) break;
+			strip(input);
+
+			test_char[0]=input[0];
+			test_char[1]='\0';
+
+			/* ignore comment */
+			if (strcmp(test_char,"#") == 0) continue;
+
+			temp_ptr=strtok(input, "=");
+			if (temp_ptr == NULL) continue;
+
+			temp_rule=strtok(NULL, "=");
+			if (temp_rule == NULL) continue;
+
+			strcpy(roles_tmp, roles);
+			role=strtok(roles_tmp, ";");
+			while (role != NULL) {
+				if (strcmp(role,temp_ptr) == 0) {
+					role_match=1;
+					break;
+				}
+				role=strtok(NULL,";");
+			}
+			if (role_match == 0) continue;
+
+			authinfo->number_of_authentication_rules++;
+			strip(temp_rule);
+
+			/* increment the authentication_rules array */
+			authinfo->authentication_rules=realloc(authinfo->authentication_rules, \
+				sizeof(char*) * authinfo->number_of_authentication_rules);
+
+			if(authinfo->authentication_rules == NULL) return -1;
+
+			authinfo->authentication_rules[authinfo->number_of_authentication_rules-1]=malloc(sizeof(char) * (strlen(temp_rule)+1));
+			strcpy(authinfo->authentication_rules[authinfo->number_of_authentication_rules-1], temp_rule);
+		}
+
+		/* free memory and close the file */
+		free(input);
+		mmap_fclose(thefile);
+	}
+	free(roles_tmp);
+}
+
 /* get current authentication information */
 int get_authentication_information(authdata *authinfo){
 	mmapfile *thefile;
@@ -58,6 +148,8 @@
 	authinfo->authorized_for_system_commands=FALSE;
 	authinfo->authorized_for_configuration_information=FALSE;
 	authinfo->authorized_for_read_only=FALSE;
+	authinfo->number_of_authentication_rules=0;
+	authinfo->authentication_rules=NULL;
 
 	/* grab username from the environment... */
 	if(use_ssl_authentication) {
@@ -168,6 +260,12 @@
                                                 authinfo->authorized_for_read_only=TRUE;
                                         }
                                 }
+			else if(strstr(input,"authorization_config_file=")==input){
+				temp_ptr=strtok(input,"=");
+				temp_ptr=strtok(NULL,"\n");
+				if(temp_ptr != NULL)
+					parse_authorization_config_file(temp_ptr, authinfo);
+				}
 		        }
 
 		/* free memory and close the file */
@@ -213,6 +311,93 @@
 	if(is_escalated_contact_for_host(hst,temp_contact)==TRUE)
 		return TRUE;
 
+	/* authz parsing */
+
+	if (authinfo->number_of_authentication_rules != 0) {
+
+		char *temp_role1;
+		char *temp_role2;
+		int i;
+		char permission[2];
+		int ok=0;
+
+		strcpy(permission, "r");
+
+		for(i=0; i < authinfo->number_of_authentication_rules; i++) {
+			char *host_list, *host_list2, *list_tmp, *host2, *tmp_permission, *tmp_service;
+
+			list_tmp=malloc(strlen(authinfo->authentication_rules[i])+1);
+			strcpy(list_tmp, authinfo->authentication_rules[i]);
+			strip(list_tmp);
+
+			/* for this situation: :service:r */
+			if (list_tmp[0] == ':') continue;
+
+			/* "w" is the maximum  permission, do not need continue */
+			if (strcmp(permission, "w") == 0) break;
+
+			host_list=strtok(list_tmp, ":");
+			host_list2=malloc(strlen(host_list)+1);
+			strcpy(host_list2, host_list);
+			tmp_service=strtok(NULL, ":");
+			tmp_permission=strtok(NULL, ":");
+			host2=strtok(host_list2, ",");
+			while (host2 != NULL) {
+				int is_ok=0;
+				char *list_tmp2 = malloc(strlen(host2)+1);
+				strcpy(list_tmp2, host2);
+				strip(list_tmp2);
+
+				/* host group parsing */
+				if (list_tmp2[0] == '@') {
+					int j;
+					char *hg_name=malloc(strlen(list_tmp2)+1);
+					strcpy(hg_name, list_tmp2);
+					for (j=0; j < strlen(hg_name); j++)
+						hg_name[j]=hg_name[j+1];
+					if (is_host_member_of_hostgroup(find_hostgroup(hg_name), hst) == TRUE) {
+						is_ok=1;
+					} else {
+						host2=strtok(NULL,",");
+						free(hg_name);
+						continue;
+					}
+					free(hg_name);
+				}
+
+				if (strcmp(list_tmp2,hst->name) == 0 || strcmp(list_tmp2,"*") == 0) is_ok=1;
+
+				if (is_ok == 1) {
+
+					/* for this situation: host::r */
+					if (tmp_permission == NULL) {
+						tmp_permission = tmp_service;
+					} else {
+						char *tmp = malloc(strlen(tmp_permission)+1);
+						strcpy(tmp, tmp_permission);
+						strip(tmp); /* "w" will overwrite "r" permission */
+
+						if (strcmp(permission, "r") == 0 && strcmp(tmp, "w") == 0)
+							strcpy(permission, "w");
+
+						free(tmp);
+					}
+					ok=1;
+				}
+				host2=strtok(NULL, ",");
+				free(list_tmp2);
+			}
+			free(list_tmp);
+			free(host_list2);
+		}
+
+		if (ok == 1) {
+			set_authz_permissions(permission, authinfo);
+			return TRUE;
+		}
+
+	} /* end of authz parsing */
+
 	return FALSE;
         }
 
@@ -296,9 +481,113 @@
 		return FALSE;
 
 	/* if this user is authorized for this host, they are for all services on it as well... */
-	if(is_authorized_for_host(temp_host,authinfo)==TRUE)
-		return TRUE;
+	if(is_authorized_for_host(temp_host,authinfo)==TRUE) {
 
+		/* authz parsing */
+
+		if (authinfo->number_of_authentication_rules != 0) {
+
+			int i;
+			char permission[2];
+			strcpy(permission, "r");
+			int ok=0;
+
+			for(i=0; i < authinfo->number_of_authentication_rules; i++) {
+
+				/* "w" is the maximum  permission, do not need continue */
+				if (strcmp(permission, "w") == 0) break;
+
+				char *host_list, *host_list2, *service_list, *list_tmp, *service, *host2, *read_only;
+				list_tmp=malloc(strlen(authinfo->authentication_rules[i])+1);
+				strcpy(list_tmp, authinfo->authentication_rules[i]);
+				host_list=strtok(list_tmp, ":");
+				host_list2=malloc(strlen(host_list)+1);
+				strcpy(host_list2, host_list);
+				service_list=strtok(NULL, ":");
+				read_only=strtok(NULL, ":");
+				service=strtok(service_list, ",");
+				while (service != NULL) {
+					int is_ok2=0;
+					char *list_tmp2;
+					list_tmp2=malloc(strlen(service)+1);
+					strcpy(list_tmp2, service);
+					strip(list_tmp2);
+
+					/* service group parsing */
+					if (list_tmp2[0] == '@') {
+						int j;
+						char *sg_name=malloc(strlen(list_tmp2)+1);
+						strcpy(sg_name, list_tmp2);
+						for (j=0; j < strlen(sg_name); j++)
+							sg_name[j]=sg_name[j+1];
+
+						if (is_service_member_of_servicegroup(find_servicegroup(sg_name), svc) == TRUE) {
+							is_ok2=1;
+						} else {
+							service=strtok(NULL,",");
+							free(sg_name);
+							continue;
+						}
+						free(sg_name);
+					}
+					if (strcmp(list_tmp2,svc->display_name) == 0 || strcmp(list_tmp2, "*") == 0) is_ok2=1;
+					if (is_ok2 == 1) {
+						host2=strtok(host_list2, ",");
+						while (host2 != NULL) {
+							int is_ok=0;
+							char *list_tmp3=malloc(strlen(host2)+1);
+							strcpy(list_tmp3, host2);
+							strip(list_tmp3);
+
+							/* host group parsing */
+							if (list_tmp3[0] == '@') {
+								int j;
+								char *hg_name=malloc(strlen(list_tmp3)+1);
+								strcpy(hg_name, list_tmp3);
+								for (j=0; j < strlen(hg_name); j++)
+									hg_name[j]=hg_name[j+1];
+
+								if (is_host_member_of_hostgroup(find_hostgroup(hg_name), temp_host) == TRUE) is_ok=1;
+								else {
+									host2=strtok(NULL,",");
+									free(hg_name);
+									continue;
+								}
+								free(hg_name);
+							}
+
+							if (strcmp(list_tmp2, svc->host_name) == 0 || strcmp(list_tmp2, "*") == 0) is_ok=1;
+
+							if (is_ok == 1) {
+								if (read_only != NULL) {
+									char *list_tmp4 = malloc(strlen(read_only)+1);
+									strcpy(list_tmp4, read_only);
+									strip(list_tmp4); /* "w" will overwrite "r" permission */
+									if (strcmp(permission, "r") == 0 && strcmp(list_tmp4, "w") == 0)
+										strcpy(permission, "w");
+
+									free(list_tmp4);
+								}
+								ok=1;
+							}
+							host2=strtok(NULL,",");
+							free(list_tmp3);
+						}
+					}
+					service=strtok(NULL,",");
+					free(list_tmp2);
+				}
+				free(list_tmp);
+				free(host_list2);
+			}
+			if (ok == 1) {
+				set_authz_permissions(permission, authinfo);
+				return TRUE;
+			}
+		} /* end of authz parsing */
+		else return TRUE;
+	}
+
 	/* find the contact */
 	temp_contact=find_contact(authinfo->username);
 
Index: nagios-3.2.1/include/cgiauth.h
===================================================================
--- nagios-3.2.1/include/cgiauth.h	(revision 176)
+++ nagios-3.2.1/include/cgiauth.h	(revision 273)
@@ -43,6 +43,8 @@
 	int authorized_for_configuration_information;
 	int authorized_for_read_only;
 	int authenticated;
+	int number_of_authentication_rules;
+	char **authentication_rules;
         }authdata;
 
 
Index: nagios-3.2.1/sample-config/cgi.cfg.in
===================================================================
--- nagios-3.2.1/sample-config/cgi.cfg.in	(revision 176)
+++ nagios-3.2.1/sample-config/cgi.cfg.in	(revision 273)
@@ -353,5 +353,7 @@
 
 #splunk_url=http://127.0.0.1:8000/
 
+# Attribute based authorization config file
 
+#authorization_config_file=@sysconfdir@/cgiauth.cfg
 
Index: nagios-3.2.1/sample-config/cgiauth.cfg.in
===================================================================
--- nagios-3.2.1/sample-config/cgiauth.cfg.in	(revision 0)
+++ nagios-3.2.1/sample-config/cgiauth.cfg.in	(revision 273)
@@ -0,0 +1,8 @@
+#urn:geant:niif.hu:testmonitor:host1admin=c6513:PING:r
+#urn:geant:niif.hu:testmonitor:host1admin=*:PING
+#urn:geant:niif.hu:testmonitor:host1admin=localhost:PING
+#urn:geant:niif.hu:testmonitor:host1admin=localhost:Swap Usage:r
+#urn:geant:niif.hu:testmonitor:superadmin=*:*:w
+#urn:geant:niif.hu:testmonitor:host1admin=@core-switches, @linux-servers:*:r
+#urn:geant:niif.hu:testmonitor:host1admin=@core-routers, @core-switches:@LDAP:w
+#urn:geant:niif.hu:testmonitor:host1admin=@core-routers, @core-switches, @linux-servers:@DNS:r

Property changes on: nagios-3.2.1/sample-config/cgiauth.cfg.in
___________________________________________________________________
Added: svn:mergeinfo

Index: nagios-3.2.1/sample-config/README
===================================================================
--- nagios-3.2.1/sample-config/README	(revision 176)
+++ nagios-3.2.1/sample-config/README	(revision 273)
@@ -29,4 +29,4 @@
 		    need to define object config files like these before you can
 		    actually start to monitor anything.
 
-                   
+cgiauth.cfg - Example config file for attribute based authorization
Index: nagios-3.2.1/configure.in
===================================================================
--- nagios-3.2.1/configure.in	(revision 176)
+++ nagios-3.2.1/configure.in	(revision 273)
@@ -803,6 +803,7 @@
 
 perl subst sample-config/nagios.cfg
 perl subst sample-config/cgi.cfg
+perl subst sample-config/cgiauth.cfg
 perl subst sample-config/resource.cfg
 perl subst sample-config/httpd.conf
 perl subst sample-config/mrtg.cfg
