Kerberos login (SSO)

[jarek]

Hi all!
I've successfully integrated Zabbix with Windoze domain via kerberos. Now I have full SSO

Here is small HOWTO:

1. Install and configure libapache2-mod-auth-kerb
2. Create keytab file for HTTP and put it in /etc/apache2/security/
3. In zabbix frontend directory create file .htaccess:

AuthType Kerberos
AuthName "Kerberos Login"
KrbAuthRealms <domain name>
require valid-user
Krb5Keytab /etc/apache2/security/zabbix.http.keytab
KrbSaveCredentials on

(ensure you have relevant AllowOverride option set in apache config).

Add the following in index.php:

 if($authentication_type == ZBX_AUTH_HTTP){
                if(isset($_SERVER['PHP_AUTH_USER']) && !empty($_SERVER['PHP_AUTH_USER'])){
                        if(!isset($sessionid)) $_REQUEST['enter'] = 'Enter';
                        $_REQUEST['name'] = $_SERVER['PHP_AUTH_USER'];
                        $_REQUEST['password'] = 'zabbix';//$_SERVER["PHP_AUTH_PW"];
                }
// Added BY JT
                elseif(isset($_SERVER['AUTH_TYPE']) && ($_SERVER['AUTH_TYPE']=='Negotiate')){
                        if(!isset($sessionid)) $_REQUEST['enter'] = 'Enter';
                        $user_parts = explode('@',$_SERVER['REMOTE_USER']);
                        $_REQUEST['name'] = $user_parts[0];
                        $_REQUEST['password'] = 'zabbix';//$_SERVER["PHP_AUTH_PW"];
                }
// End added by JT
                else{
                        access_deny();
                }
        }

4. You may want to change zabbix administrator user name from 'Admin' to 'Administrator' to unify name.
5. Change authentication in zabbix to HTTP
6. Enable kerberos ticket forwarding in web browser.
7. That's all!

Good luck.

[boy01]

Hi all!
I've successfully integrated Zabbix with Windoze domain via kerberos. Now I have full SSO

Above works w/ minor changes on our 64-bit 5.4 CentOS and zabbix server 1.6.6:

Our .htaccess file:

AuthType Kerberos
AuthName "Kerberos Login"
KrbAuthRealms <domain name>
require valid-user
Krb5Keytab /etc/krb5.zabbixkerberos.keytab
KrbSaveCredentials off
KrbMethodNegotiate on
KrbMethodK5Passwd on

Following change in above index.php patch (comment one line and add one line):

                 elseif(isset($_SERVER['AUTH_TYPE']) && ($_SERVER'AUTH_TYPE']=='Negotiate')){
                        //if(!isset($sessionid)) $_REQUEST['enter'] = 'Enter';
                       $_REQUEST['enter'] = 'Enter';
                       $user_parts = explode('@',$_SERVER['REMOTE_USER']);

User has already been authenticated w/ kerberos If we have Negotiate.
Just let him/her Enter to zabbix.

Also minor change avoiding login loop (index.php):

               redirect('logout.php');
               //redirect('index.php');
               die();

Thanks!

[jarek]

Integration with release

Is there any chance, that changes to index.php it will be integrated with official release ? I need to apply changes manually after every upgrade.

[treydock]

Kerberos login (SSO)

Thanks both of you !!! I can confirm the above works running CentOS 5.6 x64 and Zabbix 1.8.5. For me I had to install the mod_auth_kerb package. Also you have to have a working /etc/krb5.conf file. It's easy to check if your krb5.conf is valid by doing...

kinit [email protected]

be sure to capitalize DOMAIN.COM. Then the klist command will show if the ticket was created. Both the kinit and klist commands require that krb5-workstation be installed.

I used the code provided by jarek with the included change by boy01.

Since my Apache server and zabbix frontend are using virtual hosts I made the .htaccess changes in my virtual host declaration.

       <Directory /var/www/html/zabbix>
                SSLRequireSSL
                AllowOverride All
                AuthType Kerberos
                AuthName "Kerberos Login"
                KrbVerifyKDC off

                require valid-user
        </Directory>

The Kerberos server's here at my University do not give out a trust very easily and so I don't use a keytab file. Since I don't use a keytab file I had to use the KrbVerifyKDC off option to keep Apache from checking that. Otherwise I'd get an failed to verify krb5 credentials: Server not found in Kerberos database. Also I omitted the KrbAuthRealms option because Apache will use the default domain specified in the /etc/krb5.conf file.

I go into greater detail on my blog here, http://itscblog.tamu.edu/kerberos-an...on-for-zabbix/ .

- Trey

[sire]

Is there any chance, that changes to index.php it will be integrated with official release ? I need to apply changes manually after every upgrade.

Register and fill in a feature request ticket at ZABBIX Support System

[zalex_ua]

Probably it is - https://support.zabbix.com/browse/ZBX-3779