Zabbix SAML with Azure AD

[Olger]

I just spend hours searching and testing to get SAML working with Azure AD. In the end its quite simple. If you know what to do. I couldn't find a specific article about SAML specific for Azure AD (there is one with Okta which helped a bit), so figured I'd post my findings here. I'm sure there's plenty of people that would like/need to integrate with Azure AD as well.

Start by creating an Enterprise app in Azure AD. Go to "Azure Active Directory" and click on "Enterprise Application". Then click on "New Application" and next "Create my own Application". Give it a name and click "Create".
Now click on "Single sign-on" and enable SAML. Populate the Basic SAML config as follows:

Add “Users and Groups” as required. Make sure changes are saved.

Now head in to the Zabbix Administration section and click on the “SAML settings” tab. Enter the information as in the screenshot. The App ID can be found on the Properties page in the Azure AD App.

Click “Update” and SAML should now work.
Users have to exist in Zabbix before they can login using SAML. I created users as full email addresses.

Note that we don't use a proxy in front of Zabbix. I've seen some posts where proxies were used and things were a little different.
Hopefully this helps some people.

[bcarvalho]

Thank you for sharing, I've spent so many days to get this work properly... and you`re right if you run behind a proxy like IIS or NGINX reverse proxy you need to do some extas configs like editing utils.php.

[dimir]

Olger please check inbox.

[bornslippy]

I can't find any answer to this question and wondered if you had any success: Is it possible to populate the user email address in Zabbix from the mail claim upon login?

[Olger]

Sorry for the delayed reply, I haven't been sent emails that someone commented on my post.
I'm assuming that you want to add someone to the Zabbix app in Azure and have their account automatically created in zabbix? If so, thats not possible afaik. I know other services (ie Lastpass) can do automatic deployment of users once they are added in Azure to the app, but I don't know if zabbix supports that functionality.

[Jason]

I had to download the certificate from azure in pem and save it into the ui/conf/certs folder as idp.crt and add a claim for username as user.userprincipalname before it would work for me on zabbix 5.4

[johndoe2374]

I've tried to set up everything like in OP's instructions with addition of using SAML certificate, and adding a claim for username attribute like in Jason's post. No luck. Microsoft's online login page authenticates me successfully, but after that Zabbix page appears, saying that I'm not logged in, because there's no permission to access the system and "username" parameter is missing from the user attributes. I've also tried different attributes like email, but result is the same - whichever parameter you use it's missing. I suspect you need to add something else in Azure Enterprise Application settings or somewhere else. Any Azure guru to enlighten us?

[Jason]

I had to add an attribute in Azure AD. Under single sign on in User attributes and claims add username as user.userprincipalname and it should resolve it.

[johndoe2374]

I did that, it didn't help.

[Jason]

The user exists in zabbix with their username the same as their userprincipalname?

[johndoe2374]

Yes, same as user's e-mail and login: [email protected] (example).

[Jason]

Are you still getting that error above? If so that's implying it's not able to match up the username you supply with that from azure. The username attribute needs to be username in the saml settings. Also make sure that the case senstive username checkbox is unticked. Check on the logs on the front end. Have you also downloaded the certificate from azure and placed that in the front end folder?

[johndoe2374]

No errors about sign ins in server's log. Could've increased log level, but that'll take hours to find anything useful as it generates lots of stuff. Yes, certificate is there as I've said before, otherwise it gives you error other than one I'm fighting with. No checkbox is checked, just IdP ID, SSO URL, user attribute and SP entity ID (Azure app's ID with addition of "spn:"). I think that problem is on the Azure's side. It's probably trying to access user's attributes and somehow unable to do that.

[Jason]

I meant the http logs, not zabbix-server logs. Can you share a picture of the basic saml configuration from azure after clicking on the edit button to show the full info. Mask our your domain names on there and a screenshot of the zabbix saml screen, again with the app and tenant id stuff masked out

[johndoe2374]

Here's Azure and Zabbix SAML settings. Also, here's strings form my access.log for nginx (error.log is empty) which appear in the authentication moment, but there's nothing interesting (IPs and zabbix URL are replaced):

x.x.x.x - - [29/Sep/2021:11:01:39 +0300] "GET /index_sso.php HTTP/2.0" 302 0 "https://zabbix.mycompany.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31" "-"
x.x.x.x - - [29/Sep/2021:11:01:44 +0300] "POST /jsrpc.php?output=json-rpc HTTP/2.0" 200 64 "https://zabbix.mycompany.com/zabbix.php?action=authentication.edit" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31" "-"
x.x.x.x - - [29/Sep/2021:11:01:44 +0300] "POST /jsrpc.php?output=json-rpc HTTP/2.0" 200 62 "https://zabbix.mycompany.com/zabbix.php?action=charts.view&view_as=showgraph&fi lter_search_type=0&filter_hostids%5B%5D=10449&filt er_set=1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31" "-"
x.x.x.x - - [29/Sep/2021:11:01:46 +0300] "POST /jsrpc.php?output=json-rpc HTTP/2.0" 200 64 "https://zabbix.mycompany.com/zabbix.php?action=authentication.edit" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31" "-"

[Jason]

Those images are just showing as a blank screen when click on them.

[johndoe2374]

Yep, I think it's Zabbix forum's problem: I've tried different browsers ans OSes, attachments won't open properly. Just middle-click them (open in new tab) and they'll show.

[Jason]

On the user Attributes and Claims tab is there a "claim name" that is username with the value of user.userprincipalname without any of the https bit at the start? If not add one like in snip below and then try again.

[johndoe2374]

That was it! I didn't need to supply any namespace, that was the problem. Thanks a lot!

[lbukys]

"That was it!" for me also. This is the final _required_ _does_not_happen_by_itself_ step.

[BalaC]

Hi,
I Configured in the same way and getting the below issue: Any help on this?

You are not logged in

• No permissions for system access.
• SAML Response not found, Only supported HTTP_POST Binding

[Jason]

Have you looked at descriptions/screenshots above and checked your entries? What do the web logs from the front end say?

[BalaC]

Thanks Jason, its already working.

[damianjyates]

I am running into a similar problem. I renamed the cer file obtained from Azure EA saml-signon and placed it in the appropriate folder but now I receive the following error:

You are not logged in

• No permissions for system access.
• Invalid array settings: sp_certs_not_found_and_required, idp_cert_or_fingerprint_not_found_and_required

Files in directory for certs are as follows:

root@server:/usr/share/zabbix/conf/certs# ls -la
total 16
drwxr-xr-x 2 root root 4096 Feb 24 19:41 .
drwxr-xr-x 3 root root 4096 Feb 11 18:29 ..
-rw-r--r-- 1 root root 1092 Feb 24 19:41 idp.crt
-rw-r--r-- 1 root root 1092 Feb 24 19:31 Zabbix.cer

the cer file was originally downloaded from Azure. I renamed the file to idp.crt. restarted apache2 and still no change in state, same error received. what have I missed here?

[joostdeheer]

I am running into a similar problem. I renamed the cer file obtained from Azure EA saml-signon and placed it in the appropriate folder but now I receive the following error:

You are not logged in

• No permissions for system access.
• Invalid array settings: sp_certs_not_found_and_required, idp_cert_or_fingerprint_not_found_and_required

Two possible reasons:

1. You have enabled one of the sign settings and didn't add a signing certificate.
2. The user the webserver runs as (perhaps www or wwwrun, check the webserver processes) doesn't have read access to the location with the certificates

To solve 1:

Create a certificate for signing on the web server:

openssl req -x509 -newkey rsa:4096 -keyout /usr/share/zabbix/conf/certs/request-sign.pem -out /usr/share/zabbix/conf/certs/request-sign.pem -sha256 -days 1825 -nodes

Fill in the certificate questions. For common name you can use anything, e.g. ‘SAML-Request-Signing’.

Protect the key file so that only the user that the webserver runs as has access to the certificate:

chown wwwrun /usr/share/zabbix/conf/certs/request-sign.key
chmod 400 /usr/share/zabbix/conf/certs/request-sign.key

Edit the web configuration file (/etc/zabbix/web/zabbix.conf.php if you're using the official packages) and point the settings $SSO[‘SP_KEY’] and $SSO[‘SP_CERT’] to the key and cert file:

$SSO[‘SP_KEY’] = ‘conf/certs/request-sign.key’;
$SSO[‘SP_CERT’] = ‘conf/certs/request-sign.crt’;

To solve 2: Allow the wwwrun user (or whatever user the webserver is using for its processes) access to the certificate file.