Zabbix

Zabbix acts as the SAML Service Provider (SP) and Hanzo IAM as the Identity Provider (IdP). They use SAML 2.0 for single sign-on (SSO) into Zabbix.

Deploy Hanzo IAM and Zabbix. Ensure both are running and you can sign in to each.

To ensure the security of communication, certificates need to be configured between Zabbix and Hanzo IAM. Private keys and certificates should be stored in the /etc/zabbix/conf/certs/ directory, unless a custom path is provided in zabbix.conf.php.

By default, the zabbix - web - nginx - mysql Docker container looks for the following locations:

Creating certificates in Hanzo IAM: Log in to the Hanzo IAM management interface and follow the system prompts to create two certificates. These two certificates will be used for communication encryption between Zabbix and Hanzo IAM.

Copying certificates and private keys: Copy the certificate and private key to /etc/zabbix/conf/certs. With Docker, mount the local certificate files into the container.

For SAML configuration in Zabbix, three required fields need to be set: Single Sign - On, Issuer, and Public Certificate.

Log in to the Zabbix management interface, click User -> authentication -> SAML settings.

Configure Zabbix according to the SAML metadata in the Hanzo IAM configuration:

Some necessary configurations need to be made in Hanzo IAM to ensure the normal operation of the integration with Zabbix.

Editing Name and Logo: Log in to the Hanzo IAM management interface, find the relevant settings, and edit the application's name and logo for better presentation to users.

Selecting a Certificate: In Hanzo IAM, select zabbix_idp as the certificate for signing and encrypting SAML messages to ensure communication security.

Redirect URL: Enter the value that identifies your SP (Zabbix). In Zabbix this may be called Audience or Entity ID. It must match the SP entity ID in Zabbix or SSO will fail.

Reply URL: Enter the URL of the ACS (Assertion Consumer Service) for validating SAML responses. This URL is the address where Zabbix receives SAML assertions sent by Hanzo IAM.

Create a test user in Zabbix to verify SSO.

Add a user in Hanzo IAM with the same username as the one set in Zabbix.

After completing the above steps, test SSO.

Open a browser and visit localhost/index.php.

Click Sign in with Single Sign - On(SAML).

You are redirected to Hanzo IAM; enter username and password to log in.

On successful login, you are redirected back to https://localhost:8080/zabbix.index.php; SSO is then confirmed.

After completing these steps, Zabbix and Hanzo IAM are integrated for SSO. For issues, see the relevant docs or community forums.