Solution to Azure SAML - Please rectify in code

[Mallen]

Hi guys,

For a long time now Zabbix has had an issue with SAML when using Azure. This issue only seems to accur when using MS Edge if you are logged in to the same Microsoft account with Edge Profile. Issue relating to requestedAuthnContext. If I ling via Inprivate or a different profile in Edge, there is no issues.

There was an easy solution in Zabbix 5.x that seems to have been broken in 6 and 6.2. In 5 I added

$SSO['SETTINGS'] = ['requestedAuthnContext' => false];

to /etc/zabbix/web/zabbix.conf.php. V6 this doesn't seem to do anything.

Now in v6.2 I change in file /usr/share/zabbix/vendor/onelogin/php-saml/src/Saml2/Settings.php:

if (!isset($this->_security['requestedAuthnContext'])) {
$this->_security['requestedAuthnContext'] = true;
}

to:

if (!isset($this->_security['requestedAuthnContext'])) {
$this->_security['requestedAuthnContext'] = false;
}

This fixes the issue, but I think this file is not protected from upgrades as I have had to change a few times.

Would be awesome to add a tickbox to the SAML settings that disabled this setting and protected against upgrades.

[Markku]

See this post, there the syntax of the PHP code is different: https://www.zabbix.com/forum/zabbix-...802#post437802

$SSO['SETTINGS'] = [
'security' => [
'requestedAuthnContext' => false
]
];

Markku

[Mallen]

This appears to solve the issue. Thanks for that. Would be good if a checkbox in GUI but as long as there is a permanent solution, its not really a priority. Thanks again.

[drwolcot]

I am still running into this issue. I am running zabbix in docker and modified the .env_web file for the variable ZBX_SS_SETTINGS

The only modification I have made to this is for the security fields.

ZBX_SSO_SETTINGS={{"strict":false, "baseurl":"https://zabbix.domain.com/", "use_proxy_headers":true, "security":{"requestedAuthnContext":"false"}}

I am now getting this login error
[CODE]AADSTS7500524: No saml:AuthnContextClassRef or saml:AuthnContextDeclRefs elements were found within samlp:RequestedAuthnContext.[CODE]

[Neelan29]

drwolcot were you able to solve the error ^^ ??

Im running into same error. using docker 6.4. Trying to integrate fido auth.

AADSTS7500524: No saml:AuthnContextClassRef or saml:AuthnContextDeclRefs elements were found within samlp:RequestedAuthnContext

Tried :

ZBX_SSO_SETTINGS={{"strict":false, "baseurl":"https://zabbix.domain.com/", "use_proxy_headers":true, "security":{"requestedAuthnContext":"false"}}

ZBX_SSO_SETTINGS={{"strict":false, "baseurl":"https://zabbix.domain.com/", "use_proxy_headers":true, "security":{"requestedAuthnContext":"urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified"}}

[Neelan29]

solved.

workaround -> edit file

vendor/onelogin/php-saml/src/Saml2/AuthnRequest.php

replace

urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport

with

urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified

[anslu]

No luck with version 7. Anyone has found a workaround?

[rsokolovs]

Had this isse with Zabbix 7.0.6 and resolved in /etc/zabbix/web/zabbix.conf.php file with:

$SSO['SETTINGS'] = [
    'security' => [
        'requestedAuthnContext' => false
    ],
];

[anslu]

Had this isse with Zabbix 7.0.6 and resolved in /etc/zabbix/web/zabbix.conf.php file with:

$SSO['SETTINGS'] = [
'security' => [
'requestedAuthnContext' => false
],
];

Thank you!

[frank108]

Had this isse with Zabbix 7.0.6 and resolved in /etc/zabbix/web/zabbix.conf.php file with:

$SSO['SETTINGS'] = [
'security' => [
'requestedAuthnContext' => false
],
];

Thanks a lot, it works on 7.2 as well.
As I have a reverse proxy in front, I have this together:

$SSO['SETTINGS'] = [
      'use_proxy_headers' => true,
      'security' => [
          'requestedAuthnContext' => false
      ],
];