LDAP authentication with LOCAL authentication ALSO?

[mgoodman]

Right now I have LDAPS authentication enabled with Active Directory, works great.

However, I have a strong need to have BOTH LDAP accounts AND local accounts. We need to be able to create temporary accounts, service accounts, etc. within Zabbix -- but we cannot easily do this now because we do not control our active directory.

Is there a way to allow LDAP authentication in conjunction with local authentication? I.e. if User1 authenticates, it first tries LDAP, and if the authentication fails in LDAP, it then tries local authentication?

Right now it only does LDAP authentication OR local authentication, it seems.

Thanks,
Michael

[richlv]

you should be able to make users in some groups to use local auth (see group properties), but that wold not be a fallback-like approach

[mgoodman]

Thanks!

I was about to reply and ask what exactly you're talking about, but I found it:
The "GUI Access" option within a group can be set to "Internal", which will force Internal Zabbix authentication rather than the default system access (in my case, LDAPS). So, if necessary (e.g. if LDAP goes down), all users can be quickly added to a group with empty permissions that forces Internal GUI Access.

What I've done:
- Setup LDAPS (with Active Directory) authentication
- Setup all users and appropriate permissions in their respective groups, using system default GUI access
- Setup a fallback Zabbix administrator (shared admin account)
- Setup an Internal Auth group, which forces Local GUI access
- Assigned the fallback Zabbix administrator to the Internal Auth group

This allows me to have LDAPS authentication for normal users and an emergency local account.

You could also add other non-emergency users which may not have LDAP/AD accounts this way. Simply assign the user permissions/groups as normal. Then add them to the Internal Auth Local GUI Access group. This group overrides other group settings (unless they are in a group which disables access).

I've tested adding other users (which are on AD) to the Internal Auth group, and everything runs great (assuming they have a password set internally as well).

Thanks!