6.4.10 LDAP JIT provisioning does not work

[Shaman0S]

I was using 6.2.6 on production with BGmot patch. MS Active Directory as LDAP worked like a charm.

Due to necessity I updated to 6.2.9 and then 6.4.10

After update I set up JIT provisioning similar to what was set up in BGmot patch. This didn't work

So I tried different settings for 'Group name attribute' (CN or cn), 'User group membership attribute' (memberOf or memberof), tried to create differently spelled ldap groups (no spaces, no underscores, no capital letters). Didn't work either.


At the end of the day I set up fresh centos 9 + mysql + nginx + php-fpm host with 6.4.10 and made test setup as per https://blog.zabbix.com/just-in-time...ing-explained/

Unfortunately this didn't work either. Upgraded to 6.4.11 - no luck.

The most frustrating thing is when I press test button and try to test some login it authenticates and seems to detect group mapping OK.

Has anyone succeeded to set up working JIT provisioning with 6.4.10 or 6.4.11?
Appreciate your help in advance.

[BGmot]

Are you testing against my LDAP server container or your MS AD?
What exactly happens when user3 tries to log in into WebUI?

[BGmot]

Just tested with 6.4.11, works as expected.
Make sure your default authentication method is set to LDAP, without that JIT does not work.

[Shaman0S]

You nailed it! Thank you BGmot, it works with both test openldap and live MS AD.

So in case someone bumps into the same problem, please ensure

• Authentication tab, Default authentication set to LDAP
• LDAP settings tab, Enable JIT provisioning checkbox is set.

[carlos.mcnulty]

Hello, i have upgraded from 6.2 to 6.5 only to gain JIT but i have follow the youtube video from zabbix as well other guides and still won't get JIT provisioning.

Iam able to test my user and others , the group is the correct in the AD (using LDAP on ms) , al the clicks on "use jit" are done.

I hope someone can point me to the rigth direcction.

Thank you.

Carlos m