Cant get SAML with Azure AD to work

[RobinH]

Hey!

I've been following this documentation on how to set up the connection with Azure AD (https://www.zabbix.com/documentation...stall/azure_ad) but I cant get it to work. Im running Zabbix 6.4.
There has been different errors when I test the connection, the reply adress is http and not https, the reply adress is the lokal IP-adress etc. but the current one is that Zabbix tels me "Invalid array settings: idp_cert_or_fingerprint_not_found_and_required".



The Zabbix-server is behind a HAproxy, is there anything I need to configure there?

These are my settings in the frontend



The cert-file is also placed in /usr/share/zabbix/conf/certs# as ipd.cer and the settings in the zabbix.conf.php i set as
//$SSO['IDP_CERT'] = 'conf/certs/idp.cer';
//$SSO['SETTINGS'] = ['use_proxy_headers' => true];

[Alexander J]

Hi,

I am trying to get this working too but I think I got a little further than you, there is something up with the cert being wrong or mis-spelled perhaps in your case.

[Alexander J]

The cert-file is also placed in /usr/share/zabbix/conf/certs# as ipd.cer and the settings in the zabbix.conf.php i set as
//$SSO['IDP_CERT'] = 'conf/certs/idp.cer';
//$SSO['SETTINGS'] = ['use_proxy_headers' => true];

Did you write that exactly as pasted here?
it should be like this:
$SSO['IDP_CERT'] = 'conf/certs/idp.cer';
$SSO['SETTINGS'] = ['use_proxy_headers' => true];

Regards

[RobinH]

Ah, thanks! Did not se the //...

Now I get a new error when trying. It seems like I get the reply from http an not https, how do I solve this?
I have set the $SSO['SETTINGS'] = ['use_proxy_headers' => true]; but

[Alexander J]

Are you running behind a proxy?

If yes, you need to make sure your passing the headers to Zabbix.

[RobinH]

It does'nt work with the configuration $SSO['SETTINGS'] = ['use_proxy_headers' => true];
Still say the same error...

[Alexander J]

Thats exactly the error I was stuck on, the fix was adding the right headers to the proxy_pass block in Nginx.

Are you using Nginx also??

[RobinH]

Im using Apache2 for this set up.

[Alexander J]

OK,

Here is what solved the problem for me (using nginx as reverse proxy on HA-zabbix cluster)

location / {
proxy_pass http://zabbix-cluster/;
proxy_set_header Authorization $http_authorization;
proxy_pass_header Authorization;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}


It was these header statements that solved the problem.

Regards

[RobinH]

So you added these settings and the local adress for the Zabbix in Zabbix.conf.php?

[Alexander J]

So you added these settings and the local adress for the Zabbix in Zabbix.conf.php?

No, this is the nginx configuration, it will be different for you - You need to do the equivalent in Apache. (Assuming you are using it as reverse proxy, your previous replies indicate that is likely the case)

Regards