SSO and Shibboleth (eduGain)

[schaeffj]

Hello,

I'm trying to setup an SAMLv2 authentication with Shibboleth, connected to the eduGain authentication federation.

As far as I undestand the system, I set up Zabbix correctly, the "Sign in with SSO" link works as expected by redirecting the user to the SAML service provider (an apache instance whith a Shibboleth authentication setup).

The SP does it's job by redirecting to the IdP.
After authentication from the IdP, the user does not get redirected to Zabbix.

I think my apache configuration should redirect to Zabbix. Has anyone made an SSO with eduGain and could help me out ?

Cheers,

[Tgordo3]

Did you ever figure this out? I am neck deep in try to get zabbix 7 to work with shibboleth as an IdP. Not working for me either. Was trying a proxy redirect of the SAML 2.0 data to try to get back to zabbix but no luck so far.

[schaeffj]

Hi,

we concluded that Zabbix as is can not act as a standalone Service Provider. SAML support is meant to be also an Identity Provider. We gave up on this option.
It's strange to me because it does not make a lot of sens for Zabbix to be an IdP (ie. an authority for authenticating people), it should be more like configure Zabbix to trust a 3rd party IdP for authentication.

Good luck, SAMLv2 is a complicated protocol.