Zabbix - OKTA SAML wrong redirect

[bagahe]

Hey Everyone,

I have some issues configuring Zabbix (version 5.4) with OKTA as SAML. The configuration seems to work fine and it does the OKTA redirection just fine, but when I input the OKTA credentials and they are OK and I am being redirected back to zabbix, I get a 404:



I've followed the documentation and this is the current configuration I have on Zabbix for the SAML options:




Any ideas where the error might be? Have I missed something?

Best Regards,

[tim.mooney]

This is just a wild guess, but does it make a difference if you use https (instead of http) for both the Okta IdP and the Zabbix return URL?

[bagahe]

Hi Tim,

Thanks for the feedback. I tried with https on the Okta IdP and got the same result. The redirected url is the same one; which is still not found and is already on https.

Best Regards,

[tim.mooney]

Ok, thanks for testing that. PHP sometimes does some "magical" things in the name of security if it believes the connection is not secure, so I wanted to rule out that it wasn't something related to PHP stripping something out because it detected part of the process was over an insecure connection.

Are you using Apache httpd or nginx as the web server? Can you increase the log level for URL handling, including proxying, to see if there's a clue in there about why this isn't working?

[bagahe]

Hi Tim,

Thanks for your support and apologies for the delay.

We are using Apache httpd. We are not running it behind a proxy. I did the whole SSO authentication process, including the notification from OKTA and here are the logs from the webserver, where you can see the 404 and 302 issues:

Which is pretty much the same info we get from Chrome's Network Console:


Is there any other information from my side that can help debug this topic?

Best Regards.

[tim.mooney]

When you say you're not proxying, do you mean you're using mod_php7 rather than a PHP-FPM worker pool for PHP?

If you remove the "?acs" from the URL that's configured, does Okta get a different HTTP response?

[bagahe]

Hi Tim,

No, we are using PHP-FPM, I meant that the the service is not running behind a reverse proxy or anything like that.

/ui/index_sso.php is also giving a 404:

[Steve.B]

Have you setup a DNS entry for mps-zabbix.monolithicpower.com?? the subdomain does not resolve for me.

[bagahe]

Hi Steve,


Yes, it´s definitely reachable from the internal network:



Best Regards,

[Steve.B]

Guessed it might be an internal lookup only got to be carefulthese days lol

Looking at the URL in the screenshot, you're trying to go to mps-zabbix.monolithicpower.com/ui/index_sso.php. Looking at my zabbix install the ui directory doesn't exist and the index_sso.php in the / dir so mps-zabbix.monolithicpower.com/index_sso.php with our the ui sub folder.

Hi Tim,

No, we are using PHP-FPM, I meant that the the service is not running behind a reverse proxy or anything like that.

/ui/index_sso.php is also giving a 404:

[bagahe]

Hi Steve,


I´ve changed things to match the documentation and it looks like I have some progress, but still stuck on URL redirection after OKTA authentication:



These are the settings I have on OKTA SAML:



Thank you very much for your help so far.


Best Regards,

[Steve.B]

TBH I've not used any SAML soloutions "yet" is there any settings withing OKTA? the error message seems to points that http is being returned to instead of https.

[bagahe]

So, after some digging, I've fixed the issue.

Here's the solution: Set BaseURL for SAML authentication when behind a reverse-proxy · Issue #614 · zabbix/zabbix-docker (github.com)

Even if you are not using it on a docker container and doing it on /etc/zabbix/web/zabbix conf file, these are the settings that you have to add in order to get it working.
ZBX_SSO_SETTINGS={"strict":false, "baseURL":"https://<fqdn>/", "use_proxy_headers":true}

Leaving this here in case someone else finds this on google or digging though the forums.