Azure AD SAML Error

[rrspyder]

I am trying to setup SAML with Azure AD SSO. I tried both of these guides:

https://www.zabbix.com/forum/zabbix-help/402079-microsoft-adfs-saml-idp-and-zabbix-5-0-guideline

https://www.zabbix.com/forum/zabbix-cookbook/421153-zabbix-saml-with-azure-ad

However the error I get is:

AADSTS75011: Authentication method 'X509, MultiFactor' by which the user authenticated with the service doesn't match requested authentication method 'Password, ProtectedTransport'. Contact the Zabbix application owner.

Anyone else run into this and know the fix?

Thanks.

[Markku]

I've seen that as well, the workaround for me was using another browser. I don't know what caused that.

Please let us all know if you figure that out.

Markku

[falkoz]

Hi,
I solved the problem.
Cause: you use modern authentication methods like sign in with a mobile app or WHfB (Windows Hello for Business) instead of a password. The library OneLogin's SAML PHP Toolkit checks the value authncontext by default, which is completely unnecessary.

Solution: You can deactive the check as described here in advanced settings: 3 Authentication (zabbix.com)

Go to /usr/share/zabbix/conf/zabbix.conf.php
Replace

$SSO['SETTINGS']

with

$SSO['SETTINGS'] = [
'security' => [
'requestedAuthnContext' => false
]
];

Restart Zabbix