Monitoring with authentication bearer in header

[valten]

I'm trying to configure health check using Items in Zabbix.
I use 2 items:
1) Item1 - "Type - HTTP agent". Making POST request with credentials to get response in JSON format with "access token". Then using preprocessing steps' JSON Path with parameters $

.access_token

.
Checking Item1 in "Latest data" category I clearly see extracted token from JSON. I'm testing my GET request in attempt to authorize with this token from Item1 and it works well when using it manually.
2) Item2 - "Type - HTTP agent". I'm trying to get response body from GET request. Here I insert my health check URL and add into "headers" section "Authorization" "Bearer my_token_here".
Problem: My Bearer Token expires in 24 hours. I want to add my token into Item2 as variable. I tried a lot of options in headers: "Name:Authorization Value:Bearer {host.host:item.key.last()}".
Question: How to add last value "access token" from Item1 to "headers" section in form of "Name:Authorization Value:Bearer my_token_here"?
Error I'm getting from Item2 "Latest data":
{"error":{"code":"errorAuthorization","message":"U nauthorized","description":"Operation Failed. The authorization data is incorrect.","innerError":{"requestId":null,"date": "2020-03-15T18:33:44.2581078Z"}}}

[sala]

It's possible starting from 4.2 but only from web monitoring:

https://www.zabbix.com/documentation/4.2/manual/web_monitoring#configuring_steps

Unfortunately this is not ideal and I also would like to see this feature under HTTP agent.

[valten]

It's possible starting from 4.2 but only from web monitoring:

https://www.zabbix.com/documentation/4.2/manual/web_monitoring#configuring_steps

Unfortunately this is not ideal and I also would like to see this feature under HTTP agent.

Yes, I've been trying to achieve this goal with Web Monitoring as well. Web Monitoring solves my problem with Bearer Token authorization, but I face another problem. With HTTP agent I can view response body of the Item and can easily send notifications with errors from response body, when Web Monitoring doesn't keep response body at all.

[olsoncr]

I was able to accomplish this by creating a simple python script to retrieve the bearer and then use the zabbix API to update the http agent.

So basically create a python script that:

reqs: pyzabbix (pip install pyzabbix), json, requests, logging

1- Get the bearer from your web/api endpoint using 'requests' python package.
2- create a function to update the item by:

zapi = ZabbixAPI("https://127.0.0.1")
zapi.login("<zabbix api user>","zabbix api password")

jsontoken = {
'Authorization': 'Bearer '+ token
}
zapi.item.update(itemid='<your item ID>', headers=jsontoken)


If this gets any attention I could post the script in github.

[eki]

Could you please save the script to github?
I am currently working on the same situation

Thank you

[olsoncr]

Could you please save the script to github?
I am currently working on the same situation

Thank you

Here is the script, please save it as soon as you can cuz I will take it down. Not really proud of the code but it works!

https://github.com/olsoncr/zabbixlTokenUpdater

[eki]

Here is the script, please save it as soon as you can cuz I will take it down. Not really proud of the code but it works!

https://github.com/olsoncr/zabbixlTokenUpdater

Thank you very much, it works perfectly
Cheers

[julianoaguiar]

Hi @olsoncr. I have a similar application and I think that this script will help me. Did you delete it?

[fsnsantana]

I did it using a LLD, where discovery item is a HTTP agent requesting the access_token and preprocessing to output something as LLD macro {#TOKEN} with the interval you need before token expires. Then all item prototypes HTTP agent use that macro at Header "Authentication: Bearer {#TOKEN}".

If still useful to someone, I can post a template as example.

[Zablab]

Definitely useful if you still got it.

[xetrovwf]

Interested.

[mbonke]

Hi fsnsantana it would really help me to see your template

[Nunuschi]

Hello @fsnsantana
Could you post your Template please?
Thx

[Boune]

can someone post the script ?

[olsoncr]

I did not deleted it, I just marked as private. Will leave it public for a while.

https://github.com/olsoncr/zabbixTokenUpdater

[Viman]

Hi olsoncr! Thank you for your input.

I am new to Zabbix and I have a req to fetch data to my Zabbix server from several APIs, protected by OAuth 2.0, and I was planning to use the Zabbix HTTP Agent. I understand this agent is configured within the Zabbix server so the calls are made from there.

Could you please indicate a step-by-step procedure to retrieve an access token (bearer) and then attach it to the calls to the targeted APIs? For me is not clear where the python script should be placed.

Thank you!

[Bell®]

I did it using a LLD, where discovery item is a HTTP agent requesting the access_token and preprocessing to output something as LLD macro {#TOKEN} with the interval you need before token expires. Then all item prototypes HTTP agent use that macro at Header "Authentication: Bearer {#TOKEN}".

If still useful to someone, I can post a template as example.

if it's not difficult, please share your work. I am having a problem between actions LLD {#TOKEN} and Bearer {#TOKEN} they do not want to substitute a value.

[Viman]

I created this post however looks like the OAuth 2.0 topic does not get much attention in this community...

https://www.zabbix.com/forum/zabbix-help/432882-how-to-monitor-an-endpoint-protected-by-oauth-2-0