Self-replying: I've just discovered the root cause: can_submit_commands was set to 0 in contacts template definition. Works as expected now Mattia <div class="gmail_quote">On Tue, May 25, 2010 at 3:08 PM, Mattia Gandolfi <<a href="mailto:matgand@gmail.com">matgand@gmail.com</a>> wrote: <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Hi all, I'm facing problems while trying to enable LDAP authentication on a Nagios 3.2.1 install (using htpasswd.users everything works fine). This is how I've configured Apache: <Directory /usr/share/nagios/> AuthType Basic AuthName "Nagios - Ldap" AuthBasicProvider ldap AuthLDAPUrl ldaps://unixautmi-ese01.sky.local:636,unixautca-ese01.sky.local:636/ou=people,dc=sky,dc=local?uid AuthLDAPBindDN "cn=authuser,dc=sky,dc=local" AuthLDAPBindPassword oaj5Phum Require ldap-dn uid=gandolfim,ou=people,dc=sky,dc=local Require ldap-user gandolfim AuthLDAPGroupAttributeIsDN off Require ldap-group cn=systemadminmi,ou=groups,dc=sky,dc=local Require ldap-group cn=infosec,ou=groups,dc=sky,dc=local AuthLDAPGroupAttribute memberUid </Directory> <Directory "/usr/lib/nagios/cgi"> AuthType Basic AuthName "Nagios - Ldap - CGI" AuthBasicProvider ldap AuthLDAPUrl ldaps://unixautmi-ese01.sky.local:636,unixautca-ese01.sky.local:636/ou=people,dc=sky,dc=local?uid AuthLDAPBindDN "cn=authuser,dc=sky,dc=local" AuthLDAPBindPassword oaj5Phum Require ldap-dn uid=gandolfim,ou=people,dc=sky,dc=local Require ldap-user gandolfim AuthLDAPGroupAttributeIsDN off Require ldap-group cn=systemadminmi,ou=groups,dc=sky,dc=local Require ldap-group cn=infosec,ou=groups,dc=sky,dc=local AuthLDAPGroupAttribute memberUid </Directory> I've defined my username as a contact define contact { use email-contact contact_name gandolfim alias Mattia Gandolfi email <a href="mailto:mattia.gandolfi@xxxxxxx.com" target="_blank">mattia.gandolfi@xxxxxxx.com</a> pager none } and I've set the following options in cgi.cfg use_authentication=1 use_ssl_authentication=0 authorized_for_system_information=gandolfim authorized_for_configuration_information=gandolfim authorized_for_system_commands=gandolfim authorized_for_all_services=gandolfim authorized_for_all_hosts=gandolfim authorized_for_all_service_commands=gandolfim Authentication works fine, and I see "Logged in as gandolfim" on top of the Tactical Monitoring Overview page. However, as soon as I try to access the cgi, for example to disable notifications for a service, I get "Sorry, but you are not authorized to commit the specified command." What am I missing? Thanks Mattia </blockquote></div>