Monitoring REST API requiring OAuth2 Bearer Tokens

[yuri69]

Hello,
Is there a way to monitor a REST API service secured by OAuth2 using Zabbix 4?

Ideally the setup would look like this:

1. Request Auth Token at an OAuth2 endpoint (basically a HTTP POST)
   1. send USER+PW, parse and save the token from the response
2. Use the saved token and an API key to request data from the REST API endpoint
   1. send the token in a HTTP header and HTTP GET the data from endpoint
3. Ensure the HTTP response is valid
   1. HTTP 200
4. Parse the JSON response body and save the a specific parsed value as a Zabbix Item
   1. use JSONPath
5. A Zabbix Trigger would use the Zabbix Item's value

I've successfully created a Zabbix Web Scenario authenticating and checking the HTTP response code. However, I couldn't find a way to extract/parse the response JSON body.

Any ideas, please?

[valten]

Hello,
Is there a way to monitor a REST API service secured by OAuth2 using Zabbix 4?

Did you find any success? I'm facing the same problem with inability to get response body.

[yuri69]

Did you find any success? I'm facing the same problem with inability to get response body.

Sadly, I did not. It feels like Zabbix is not the right tool for this kind of application level monitoring. Zabbix is kind of targeted at the infrastructure.

[Avinasha]

This can be done Using Zabbix Web URL monitoring. You can run a HTTP POST with Username and password and Use a variable to grab the token response and use this variable in next step to authenticate it. Let me know if you want more details on this.

[surya_99]

Hi Avinasha, I've grab the token from HTTP Post but now how can we use token to authenticate in get http agent. Received token is working in curl command.

curl -X GET "http://<WAF IP/Domain>:8000/restapi/v3/services?category=operational" -H "accept: application/json" -u "token:"

[yuri69]

This can be done Using Zabbix Web URL monitoring. You can run a HTTP POST with Username and password and Use a variable to grab the token response and use this variable in next step to authenticate it. Let me know if you want more details on this.

Do you mean https://www.zabbix.com/documentation...web_monitoring by By Web URL monitoring? If so, after the authentication I need to parse a value from the actual response body not just a HTTP status code.

Parsing a non-trivial JSON payload to a Web Scenario Variable using regex doesn't seem right. In my case I need to parse the service response.

[chok]

I wanted to do the same. You can have further informations here : https://www.zabbix.com/documentation...toring/example

[richard.ostrochovsky]

Since ZBX 5.2, it is possible to implement this also using Script item: https://www.zabbix.com/documentation...emtypes/script, which has an advatage of being usable also in low level discovery (in comparison with web scenario). I am using it this way (with OAuth2 Bearer tokens).

[Grumpyblade1994]

Since ZBX 5.2, it is possible to implement this also using Script item: https://www.zabbix.com/documentation...emtypes/script, which has an advatage of being usable also in low level discovery (in comparison with web scenario). I am using it this way (with OAuth2 Bearer tokens).

How did you archieved this? I have a similar Problem with OAuth2. Can you explain this to me?

[rahuls1436]

yuri69 can you help me with step 5? I am able to prase access code to the jsonpath, now i am unable to figure out how to use the token in web scenario.

[yuri69]

yuri69 can you help me with step 5? I am able to prase access code to the jsonpath, now i am unable to figure out how to use the token in web scenario.

Great, jsonpath is cool. Save the token as a variable in the Variables section of the Web Scenario Step. Then simply use the variable in a following Step of the Web Scenario.

For example, the token would be saved to a

{access_token}

variable in the first Step. Then use it as Name:

Authorization

and Value:

Bearer {access_token}

in the Headers section of the second Step. The second Step would simply require the 200 status code.

[kajaaj]

Hi yuri69 , I followed your steps, buit it is not working for me. I have a token that is one year valid, so I only need to log in to a page with token to search for required string. Is this the correct way (see screenshots)?

[cyber]

Why bother with variables, if you can construct full header at once?

[kajaaj]

Good point, thanks!

[kajaaj]

yuri69 how did you manage to save the token in a variable in your first Step, to use it in your second Step?

I am trying to do this as is written here: https://www.zabbix.com/documentation...toring/example --> with regex:name="csrf-token" content="([0-9a-z]{16})"

But the problem is, that when I request for a token I only have an empty page with token which I have to save in variable, so I can not use regex:... as is stated above

My HTML Page with token, which I have to save as a variable to use it in 2. Step.

[Dwayne]

you have a mix of case, I'm also not counting characters so make sure {16} is right if its range make that a range to suit

content="([0-9a-zA-Z]{16})"

[rdf.8888]

I have the same issue, a need to do HTTP checks, I already have the token, but after one hour a need it a new token. It would be useful if a can push a new token on macro something like

{$TOKEN} = {?last(//baerer.token)}

Does anyone know how to solve that?