SAML zabbix instructions

[bbrendon]

The docs didn't work. This did. It took me many hours to figure this out, probably because this is my first real foray into SAML.

Zabbix

After that is setup, you'll have two options on the login screen. One for normal and a button below it for saml.

Also, create a user in zabbix called akadmin to make testing all this easier. The user in Authentik has to match the user in zabbix.

Copy Certs to zabbix server

In Authentik Goto System -> Certificates
download the key and cert for "authentik Self-signed Certificate".

copy them to the directory below with the names below. Notice the file size for idp.crt and sp.crt are the same, it's because they are the same :) . No idea if this is correct but it worked.

% ls -l /usr/share/zabbix/conf/certs
total 16
-rw-r--r-- 1 root root 1814 Jan 28 19:34 idp.crt
-rw-r--r-- 1 root root 1814 Jan 28 19:34 sp.crt
-rw-r--r-- 1 root root 3243 Jan 28 19:34 sp.key
%

Authentik

Application -> Providers -> Create SAML Provider

Applications -> Applications -> Create

Done

I hope I didn't miss anything. Good luck.

[TheBinaryLoop]

Hey @bbrendon, I did everything exactly as you wrote here, but I get the error

"Invalid array settings: idp_cert_or_fingerprint_not_found_and_required"

do you have any idea on how I can resolve that?

[TheBinaryLoop]

Zabbix SAML Login Screen

[bbrendon]

This is what i have in my notes for that error. Not really sure what it means.

https://www.zabbix.com/forum/zabbix-help/425857-saml-is-not-working-properly

'strict' => true,
'debug' => false,

[OliverKarger]

@TheBinaryLoop i was able to fix this Error by configuring this Environment Variable for the Zabbix Frontend

ZBX_SSO_SETTINGS: "{'baseurl': 'https://zabbix-docker.mydomain.com', 'use_proxy_headers': true, 'strict': false}"

Source: https://hub.docker.com/r/zabbix/zabbix-web-nginx-mysql

Here is a complete example of a working config for docker:

environment:
      ZBX_SSO_SP_KEY: /usr/share/zabbix/conf/certs/sp.key
      ZBX_SSO_SP_CERT: /usr/share/zabbix/conf/certs/sp.crt
      ZBX_SSO_IDP_CERT: /usr/share/zabbix/conf/certs/idp.crt
      ZBX_SSO_SETTINGS: "{'baseurl': 'https://nms.your-url.de', 'use_proxy_headers': true, 'strict': false}"
volumes:
      - ../config/zabbix/sp.key:/usr/share/zabbix/conf/certs/sp.key
      - ../config/zabbix/sp.crt:/usr/share/zabbix/conf/certs/sp.crt
      - ../config/zabbix/sp.crt:/usr/share/zabbix/conf/certs/idp.crt

[TheBinaryLoop]

@OliverKarger Wow. Thank you. Wasn't expecting a solution anymore

[OliverKarger]

@TheBinaryLoop i just realized after attempting to provoke this error again, the "solution" i proposed isn't actually the solution.

The correct Solution (i think) is to add idp.crt into the Frontend Container. I just used the same Authentik Self Signed Certificate as for sp.crt.

What i proposed could fix a later Issue. I had the Problem, where i got to the Authentik Login Screen but then i was told that the ACS Url did not match. The Frontend Url doesn't seem to be used for SAML SSO.

[1977er]

At least in Zabbix version 6.0 LTS you want to avoid EC certs and stick with RSA certs.

[alexsalex]

Looks like I follow the steps, but get this error:

You are not logged in
System error occurred. Please contact Zabbix administrator.
Invalid SAML Response. Not match the saml-schema-protocol-2.0.xsd

Could somebody help to figure out a solution?