3 Authentication

Overview

In Administration → Authentication the global user authentication method to Zabbix can be specified. The available methods are internal, HTTP, LDAP and SAML authentication.

By default, Zabbix uses internal Zabbix authentication for all users. It is possible to change the default method to LDAP system-wide or enable LDAP authentication only for specific user groups.

To set LDAP as default authentication method for all users, navigate to the LDAP tab and configure authentication parameters, then return to the Authentication tab and switch Default authentication selector to LDAP.

Note that the authentication method can be fine-tuned on the user group level. Even if LDAP authentication is set globally, some user groups can still be authenticated by Zabbix. These groups must have frontend access set to Internal. Vice versa, if internal authentication is used globally, LDAP authentication details can be specified and used for specific user groups whose frontend access is set to LDAP. If a user is included into at least one user group with LDAP authentication, this user will not be able to use internal authentication method.

HTTP and SAML 2.0 authentication methods can be used in addition to the default authentication method.

HTTP authentication

HTTP or web server-based authentication (for example: Basic Authentication, NTLM/Kerberos) can be used to check user names and passwords. Note that a user must exist in Zabbix as well, however its Zabbix password will not be used.

Configuration parameters:

LDAP authentication

External LDAP authentication can be used to check user names and passwords. Note that a user must exist in Zabbix as well, however its Zabbix password will not be used.

While LDAP authentication is set globally, some user groups can still be authenticated by Zabbix. These groups must have frontend access set to Internal. Vice versa, if internal authentication is used globally, LDAP authentication details can be specified and used for specific user groups whose frontend access is set to LDAP.

Zabbix LDAP authentication works at least with Microsoft Active Directory and OpenLDAP.

Configuration parameters:

SAML authentication

SAML 2.0 authentication can be used to sign in to Zabbix. Note that a user must exist in Zabbix, however, its Zabbix password will not be used. If authentication is successful, then Zabbix will match a local username (alias) with the username attribute returned by SAML.

Setting up the identity provider

In order to work with Zabbix, a SAML identity provider (onelogin.com, auth0.com, okta.com, etc.) needs to be configured in the following way:

• Assertion Consumer URL should be set to <path_to_zabbix_ui>/index_sso.php?acs
• Single Logout URL should be set to <path_to_zabbix_ui>/index_sso.php?sls

<path_to_zabbix_ui> examples: %% https://example.com/zabbix/ui, http://another.example.com/zabbix, http://<any_public_ip_address>/zabbix %%

Setting up Zabbix

To use SAML authentication Zabbix should be configured in the following way:

1. Private key and certificate should be stored in the // ui/conf/certs///, unless custom paths are provided in zabbix.conf.php.

By default, Zabbix will look in the following locations:

• ui/conf/certs/sp.key - SP private key file
• ui/conf/certs/sp.crt - SP cert file
• ui/conf/certs/idp.crt - IDP cert file

2. All of the most important settings can be configured in the Zabbix frontend. However, it is possible to specify additional settings in the configuration file.

Configuration parameters, available in the Zabbix frontend:

Advanced settings

Additional SAML parameters can be configured in the Zabbix frontend configuration file (zabbix.conf.php):

• $SSO['SP_KEY'] = '<path to the SP private key file>';
• $SSO['SP_CERT'] = '<path to the SP cert file>';
• $SSO['IDP_CERT'] = '<path to the IDP cert file>';
• $SSO['SETTINGS']

Only the following options can be set as part of $SSO['SETTINGS']:

• strict
• baseurl
• compress
• contactPerson
• organization
• sp (only options specified in this list)
  • attributeConsumingService
  • x509certNew
• idp (only options specified in this list)
  • singleLogoutService (only one option)
    • responseUrl
  • certFingerprint
  • certFingerprintAlgorithm
  • x509certMulti
• security (only options specified in this list)
  • signMetadata
  • wantNameId
  • requestedAuthnContext
  • requestedAuthnContextComparison
  • wantXMLValidation
  • relaxDestinationValidation
  • destinationStrictlyMatches
  • rejectUnsolicitedResponsesWithInResponseTo
  • signatureAlgorithm
  • digestAlgorithm
  • lowercaseUrlencoding

All other options will be taken from the database and cannot be overridden. The debug option will be ignored.

In addition, if Zabbix UI is behind a proxy or a load balancer, the custom use_proxy_headers option can be used:

• false (default) - ignore the option;
• true - use X-Forwarded-* HTTP headers for building the base URL.

If using a load balancer to connect to Zabbix instance, where the load balancer uses TLS/SSL and Zabbix does not, you must indicate 'baseurl', 'strict' and 'use_proxy_headers' parameters as follows:

$SSO['SETTINGS']=['strict' => false, 'baseurl' => "https://zabbix.example.com/zabbix/", 'use_proxy_headers' => true]

Configuration example:

$SSO['SETTINGS'] = [
           'security' => [
               'signatureAlgorithm' => 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384'
               'digestAlgorithm' => 'http://www.w3.org/2001/04/xmldsig-more#sha384',
               // ...
           ],
           // ...
       ];