Issues with LDAP Group Retrieval via DUO Proxy in Zabbix

[NotHugo]

I'm currently configuring LDAP authentication for Zabbix, with DUO set up as an MFA intermediary using the DUO Authentication Proxy.

When using the DUO Proxy, Zabbix successfully authenticates users (I get "login successful"), but none of the LDAP attributes—specifically User role, User groups, and Media type—are retrieved. They all show as "No Value."

Tested connecting directly to the DC without DUO, and this worked as expected, with all attributes retrieved successfully.

Some might suggest that DUO is the issue, but I have other services using DUO in a similar fashion, and they’re able to retrieve LDAP attributes without any problems.
This behavior appears specific to Zabbix with the DUO proxy configuration.

Has anyone successfully configured DUO to relay LDAP group and role attributes to Zabbix?
Are there recommended configurations for DUO’s authproxy.cfg or Zabbix’s LDAP group pattern that ensure groups are retrieved?
Any other potential troubleshooting steps I might have missed?

[freiheit]

I have this working, with Active Directory as the backend LDAP. Currently on Zabbix 7.0.5, but worked the same on Zabbix 6.4.x.

[ldap_server_auto2]
port=38902
ssl_port=63602
ikey=REDACTED
skey=REDACTED
api_host=api-redacted.duosecurity.com
client=ad_client
failmode=safe
ssl_cert_path=/etc/letsencrypt/live/duoauthproxy.example.com/fullchain.pem
ssl_key_path=/etc/letsencrypt/live/duoauthproxy.example.comt/privkey.pem
exempt_primary_bind=false
allow_unlimited_binds=true
exempt_ou_1=CN=Zabbix LDAP,OU=Redacted,DC=Redacted

Zabbix LDAP config:
- Port: 38902
- Base DN: OU=Redacted,DC=Redacted
- Search Attribute: sAMAccountName
- Bind DN: CN=Zabbix LDAP,OU=Redacted,DC=Redacted
- Configure JIT provisioning: yes
- Group configuration: memberOf
- Group name attribute: CN
- User group membership attribute: memberOf
- User name attribute: givenName
- User last name attribute: sn
- Media type mapping: Name:Email(HTML), Media type: Email(HTML), Attribute:mail, create enabled: yes
- StartTLS: yes