Web Scenario; Basic Authentication failure

[Maxburn]

I have a web site that I would like to verify is up and it uses basic authentication, and I can get in with any browser. The server is IIS and it hosts three sites with subdomains and HTTP->HTTPS upgrades. site1.example.com, site2.example.com etc.

I have many other web scenarios but this is the first one I've attempted with basic authentication so I set it up like any other site plus the basic authentication. The details come back:

response code; 401 (unauthorized) Status; Error: required pattern "information" was not found on https://site.example.com

Looking deeper I don't think this is a Zabbix failure because when I go to CLI on that server and attempt a curl with user/password I get similar error;

curl https://myuser:[email protected]/index.html
~
<title>401 - Unauthorized: Access is denied due to invalid credentials.</title>

Things get more interesting if I use wget, it works after a couple 401's and pulls down the file I wanted successfully (valid content);

myuser@ubnt20-04-zbxv5:~$ wget --http-user=myuser --http-password=mypassword https://site.example.com/staging.html
--2021-09-29 07:54:03-- https://site.example.com/staging.html
Resolving site.example.com (site.example.com)... 100.18.169.148
Connecting to site.example.com (site.example.com)|100.18.169.148|:443... connected.
HTTP request sent, awaiting response... 401 Unauthorized
Authentication selected: NTLM
Reusing existing connection to site.example.com:443.
HTTP request sent, awaiting response... 401 Unauthorized
Authentication selected: NTLM TlRMTVNTUAACAAAABQAFADgAAAA~~~~~~~wAbwBjAGEAbAAHAA gArOzURSi11wEAAAAA
Reusing existing connection to site.example.com:443.
HTTP request sent, awaiting response... 200 OK
Length: 3679 (3.6K) [text/html]
Saving to: ‘staging.html’

staging.html 100%[================================================== ================================================== ================================================== ==============================================>] 3.59K --.-KB/s in 0s

2021-09-29 07:54:03 (1.04 GB/s) - ‘staging.html’ saved [3679/3679]

So is there something I can do in Zabbix to make it behave more like wget instead of curl? If you have a clue on what I need to change on the IIS server also let me know.

[tim.mooney]

When a web client and a web server interact, they negotiate things like protocol version, response types, and in this case, authentication methods.

I have very little experience with IIS, but some quick web searching seems to imply that IIS defaults to "Windows Authentication", and doesn't offer "Basic Authentication" as an option (by default) to the client.

You don't say what version of Zabbix you're using, but current documentation indicates that there should be a drop-down menu for "HTTP Authentication" when you configure the web check, and "NTLM" should be one of the options. If that's true, try that. It should allow Zabbix to negotiate "NTLM" with the server, and hopefully things will work. Note that Zabbix's web checks are based on the underlying libcurl library for your system, so your libcurl and curl documentation may also be useful.

The other option (I think; again, I'm not an IIS person) would be to modify the IIS site config for these sites to enable "Basic Authentication" and perhaps make sure it's at the start of the list, before "NTLM". If you do that, the Zabbix web check should be able to continue to use HTTP Basic Authentication to access the site. Note that enabling Basic Authentication for the site may require additional configuration setup. Not sure how IIS does it, but hopefully you can find the require documentation.

[Maxburn]

That's the problem. Looks like basic auth to me in a browser and I didn't realize zabbix had the NTLM option. Changing to NTLM in zabbix was the fix here.