nagios ALL= NOPASSWD: /usr/local/nagios/libexec/check_edir_time
and then the script ran perfectly. It's great!
I guess a similar script could be used to check edir sync as well.
This is a check script which runs ndsrepair on an OES (linux) server and alerts if the time is out of sync from eDirectory's point of view on any contactable servers. It also outputs a list of any servers that couldn't be contacted.