How to setup JIT users in Zabbix SSO using Google Workspace

[Beetle]

I have recently upgraded to v7.0.3 and am able to setup SAML SSO using Google workspace by creating local users in Zabbix. Now I'm trying to setup SAML - JIT using Google workspace without creating local users in Zabbix.

After successfully authenticated with the Google I'm facing the below error in Zabbix page.




Under user group mapping, I have added a group from google workspace in group pattern.



In Google workspace I have added the group in App attribute.




Can anyone provide the setup steps for JIT using Google Workspace.

[Beetle]

The issue is now resolved. I'm successfully able to login via SSO as a JIT provisioned user.

The only mistake I made is to mention the Group Name instead of the Group Mail ID.




In Google Groups,

[jhboricua]

I'm going to assume that the group being setup is not actually [email protected] but admins@<your google workspace domain>, right?

[jhboricua]

I'm going to assume that the group you're setting up is not actually what's on the screenshot but admins at <your Google Workspace domain suffix>?

[Beetle]

Yes you are correct. The actual domain is something else.

[jhboricua]

Do you have to do something on the Google side of things for JIT as described here?

https://cloud.google.com/chronicle/docs/soar/admin-tasks/saml-soar-only/what-is-justintime-user-provisioning

[Beetle]

The issue is now resolved. I'm successfully able to login via SSO as a JIT provisioned user.

The only mistake I made is to mention the Group Name instead of the Group Mail ID.




In Google Groups,