[ZBXNEXT-4663] Support OpenID Connect authentication Created: 2018 Aug 01  Updated: 2018 Aug 02  Resolved: 2018 Aug 02

Status: Closed
Project: ZABBIX FEATURE REQUESTS
Component/s: Frontend (F)
Affects Version/s: None
Fix Version/s: None

Type: New Feature Request Priority: Trivial
Reporter: AJelenc Assignee: Unassigned
Resolution: Workaround proposed Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Attachments: Zip Archive oidc4zbx.zip    

 Description   

What is OpenID Connect?

"OpenID Connect 1.0 is a simple identity layer on top of the OAuth 2.0 protocol. It allows Clients to verify the identity of the End-User based on the authentication performed by an Authorization Server, as well as to obtain basic profile information about the End-User in an interoperable and REST-like manner." (http://openid.net/connect) 

Why?

With OpenID Connect we delegate our user authentication from Zabbix front-end to another trusted party. In enterprise environments, there are heavy requirements for 2FA and Single Sign-On. All this can be achieved using OpenID Connect.

What is already done?

  • I have integrated OpenID Connect mechanism into Zabbix 4.0.0alpha8 web frontend (all files are in the attachment below)
  • My documentation can be found inside OIDC.md file.
  • Some database changes have been done and are visible inside schema.sql.
  • Verifying JWT Tokens are made using php-jwt library (https://github.com/firebase/php-jwt).

 

I am really interested in integrating OpenID Connect into Zabbix's next release, so I am available for making some more changes if necessary.

 

 

 Comments   
Comment by Gregory Chalenko [ 2018 Aug 01 ]

Wouldn't it be better to delegate openid authentication to web server module (for example mod_auth_openidc for apache) and use already implemented in Zabbix HTTP authentication? After ZBXNEXT-4573 implementation HTTP authentication will be made as additional authentication method for internal or LDAP.
Anyway thank you for your interest and time you invested in solution!

Comment by AJelenc [ 2018 Aug 02 ]

I totally missed that option, thank you for bringing up HTTP authentication. I agree, that's way better. I am going to close this issue now.

Comment by AJelenc [ 2018 Aug 02 ]

Using zabbix HTTP authentication we delegate openid connect authenticatio to web server module.

Generated at Tue Apr 29 09:11:13 EEST 2025 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.