SAML SSO with Azure AD

[msnelling]

Hi,
I'm trying to get SAML SSO login working with Zabbix, not for web-monitoring, but for authentication/authorisation to the web UI. However I'm getting the following error.
The response was received at http://zabbix.example.com:8080/index_sso.php instead of https://zabbix.example.com/index_sso.php?acs
I'm running the Zabbix web frontend (as well as all the oher components) in a Docker container with a Traefik v2.2 reverse-proxy which handles the TLS termination, this works really well for every aspect of my setup except for the above error during the SAML exchange.
It looks like the web UI component is getting confused that the SAML response is coming in on my reverse-proxy URL instead of directly to the docker container and port.
IS there some config I'm missing somewhere?
Thanks,
Mark

[netboss]

I had the same issue. I also have separate docker for zabbix frontend. Here is how I resolved this error message:
1)change exposed ports in a docker from 0.0.0.0:443 => 8843, 0.0.0.0:80 = 8080 to 0.0.0.0:443 => 443, 0.0.0.0:80 : 80
2)change configuration file on nginx to listen 443 and 80
3)start a docker again and test

In my case it did not work and I had the following error message in a docker:

bind() to 0.0.0.0:443 failed (13: Permission denied)

Port 443 is a restricted port (below 1024) and can only be bound to by an admin.
I resolved it using setcap command.

setcap cap_net_bind_service=+ep /usr/sbin/nginx

I beleive there should be easier way to solve it, but this was mine...

[msnelling]

Thanks for the response. I don't think this solution will work for me as I have my Traefik reverse-proxy exposed ports listening on 80 and 443.

[joseperes]

Guys I have the same issue, I have Traefik reverse-proxy .... msnelling did you find out ?

[msnelling]

Guys I have the same issue, I have Traefik reverse-proxy .... msnelling did you find out ?

No nothing yet, I've posted an issue on GitHub https://github.com/zabbix/zabbix-docker/issues/614

[joseperes]

No nothing yet, I've posted an issue on GitHub https://github.com/zabbix/zabbix-docker/issues/614

I found a workaround !
just edit the file /usr/share/zabbix/vendor/php-saml/src/Saml2/Utils.php in the frontend container. (make sure to point this file to persist on docker volume)
edit the line

private static $_proxyVars = false;

to

private static $_proxyVars = true;

Now is working fine with Traefik 2.2.1 + Zabbix 5.0.1

[tivrobo]

God bless you! Need to merge this into the Zabbix code or add these settings to Zabbix Frontend Configuration.