Zabbix SAML issue

[Gblaze56]

Hello all,

I was wondering if anyone else had issue trying to use saml with AWS SSO? in this case i am receiving the following error .

You are not logged in

• No permissions for system access.
• Invalid SAML Response. Not match the saml-schema-protocol-2.0.xsd

This is when I click on the link in AWS SSO portal.

Any assistance would be appreciated!

[LenR]

Did you create the user in Zabbix first?

[Gblaze56]

yes the users have all been created in Zabbix.

[LenR]

I think the first error is the result of the second. I searched for "Not match the saml-schema-protocol-2.0.xsd" and it seems the consensus is that it can be several different things, problems with signing assertions, not including any user attributes. You may just have to work thru those things one by one.

[Gblaze56]

Thanks i did the same, what I was hoping for was a some places to start, I looked at auth.log zabbix-server .logs and didn't see anything to help.

[Gblaze56]

So is there a list of Username Attributes that Zabbix uses?

[LenR]

Username Attribute, which I think must match the user you predefine to Zabbix

https://www.zabbix.com/forum/zabbix-...-5-0-guideline

But the name of that field depends on your SAML environment. Note in that link one user had "uid", another had "Alias" and we use sAmAccountName, case matters and that probably isn't right, I didn't go look.

[Gblaze56]

I tried all of those as well , what's hampering me is the lack of logging, i can't really see what the issue is as the error messages are vague at best.

[LenR]

I think the logs you need are on the isp as would the knowledge of the user attribute field name.

[Gblaze56]

Tried those nothing in them worthwhile

[Gblaze56]

Through sheer luck i was able to get it working by creating a sp-metadata file and creating user attributes that were set to use email. And as well setting up index_sso.php to work with sso.

[aalmeidaaccelaero]

hi Can you share your steps and let me know what steps you took to get his resolved

[Jason]

In order to get this to work I needed to download the certificate (from azure) in pem format and put in idp.crt in the ui/conf/certs folder and define an additional attribute under username and claims called username that mapped to user.userprincipalname

[mfuk]

Hi Gblaze56 I have the same problem.
Could I ask you share your configuration please?

and in particular:

vim /usr/share/zabbix/conf/zabbix.conf.php
$SSO['SP_KEY'] = '/etc/ldap/ssl/key.pem';
$SSO['SP_CERT'] = '/etc/ldap/ssl/cert.pem';
$SSO['IDP_CERT'] = '/etc/ldap/ssl/idp.crt';
$SSO['SETTINGS'] = [];

and the config in the Zabbix GUI for SAML Settings:

[LIST][*]Enable SAML authentication[*]IdP entity ID[*]SSO service URL[*]SLO service URL[*]Username attribute[*]SP entity ID[*]SP name ID format[*]Sign[LIST][*]Messages[*]Assertions[*]AuthN requests[*]Logout requests[*]Logout responses[/LIST][*]Encrypt[LIST][*]Name ID[*]Assertions[/LIST][*]Case-sensitive login[/LIST]​

Thanks a lot for your help.