Áú»¢¶Ä²©

10 §¯§Ñ§ã§ä§â§à§Û§Ü§Ñ SAML §ã Okta

§£ §ï§ä§à§Þ §â§Ñ§Ù§Õ§Ö§Ý§Ö §à§á§Ú§ã§í§Ó§Ñ§Ö§ä§ã§ñ, §Ü§Ñ§Ü §ß§Ñ§ã§ä§â§à§Ú§ä§î Okta §Õ§Ý§ñ §Ó§Ü§Ý§ð§é§Ö§ß§Ú§ñ §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§Ú SAML 2.0 §Õ§Ý§ñ Áú»¢¶Ä²©.

§¯§Ñ§ã§ä§â§à§Û§Ü§Ñ Okta

1. §±§Ö§â§Ö§Û§Õ§Ú§ä§Ö §ß§Ñ §Ú §Ù§Ñ§â§Ö§Ô§Ú§ã§ä§â§Ú§â§å§Û§ä§Ö§ã§î §Ú§Ý§Ú §Ó§à§Û§Õ§Ú§ä§Ö §Ó §ã§Ó§à§ð §å§é§Ö§ä§ß§å§ð §Ù§Ñ§á§Ú§ã§î.

2. §£ §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã§Ö Okta §á§Ö§â§Ö§Û§Õ§Ú§ä§Ö §Ó §±§â§Ú§Ý§à§Ø§Ö§ß§Ú§ñ ¡ú §±§â§Ú§Ý§à§Ø§Ö§ß§Ú§ñ §Ú §ß§Ñ§Ø§Þ§Ú§ä§Ö §Ü§ß§à§á§Ü§å "§¥§à§Ò§Ñ§Ó§Ú§ä§î §á§â§Ú§Ý§à§Ø§Ö§ß§Ú§Ö". ().

3. §¯§Ñ§Ø§Þ§Ú§ä§Ö §Ü§ß§à§á§Ü§å "§³§à§Ù§Õ§Ñ§ä§î §ß§à§Ó§à§Ö §á§â§Ú§Ý§à§Ø§Ö§ß§Ú§Ö".(). §£§à §Ó§ã§á§Ý§í§Ó§Ñ§ð§ë§Ö§Þ §à§Ü§ß§Ö §Ó§í§Ò§Ö§â§Ú§ä§Ö §±§Ý§Ñ§ä§æ§à§â§Þ§Ñ: §£§Ö§Ò, §®§Ö§ä§à§Õ §Ó§ç§à§Õ§Ñ: SAML 2.0 §Ú §ß§Ñ§Ø§Þ§Ú§ä§Ö §Ü§ß§à§á§Ü§å "§³§à§Ù§Õ§Ñ§ä§î".

4. §©§Ñ§á§à§Ý§ß§Ú§ä§Ö §á§à§Ý§ñ §ß§Ñ §Ó§Ü§Ý§Ñ§Õ§Ü§Ö §°§Ò§ë§Ú§Ö §ß§Ñ§ã§ä§â§à§Û§Ü§Ú (§á§Ö§â§Ó§Ñ§ñ §à§ä§Ü§â§í§Ó§ê§Ñ§ñ§ã§ñ §Ó§Ü§Ý§Ñ§Õ§Ü§Ñ) §Ó §ã§à§à§ä§Ó§Ö§ä§ã§ä§Ó§Ú§Ú §ã §Ó§Ñ§ê§Ú§Þ§Ú §á§â§Ö§Õ§á§à§é§ä§Ö§ß§Ú§ñ§Þ§Ú §Ú §ß§Ñ§Ø§Þ§Ú§ä§Ö "§¥§Ñ§Ý§Ö§Ö".

5. §¯§Ñ §Ó§Ü§Ý§Ñ§Õ§Ü§Ö §¯§Ñ§ã§ä§â§à§Ú§ä§î SAML §Ó§Ó§Ö§Õ§Ú§ä§Ö §Ù§ß§Ñ§é§Ö§ß§Ú§ñ, §å§Ü§Ñ§Ù§Ñ§ß§ß§í§Ö §ß§Ú§Ø§Ö, §Ù§Ñ§ä§Ö§Þ §ß§Ñ§Ø§Þ§Ú§ä§Ö ?§¥§Ñ§Ý§Ö§Ö?.

• §£ §â§Ñ§Ù§Õ§Ö§Ý§Ö §°§¢§»§ª§¦:
  • URL-§Ñ§Õ§â§Ö§ã §Õ§Ý§ñ §Ö§Õ§Ú§ß§à§Ô§à §Ó§ç§à§Õ§Ñ: https://<your-zabbix-url>/ui/index_sso.php?acs
    §¶§Ý§Ñ§Ø§à§Ü §ª§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ä§î §Õ§Ý§ñ URL-§Ñ§Õ§â§Ö§ã§Ñ §á§à§Ý§å§é§Ñ§ä§Ö§Ý§ñ... §Õ§à§Ý§Ø§Ö§ß §Ò§í§ä§î §à§ä§Þ§Ö§é§Ö§ß.
  • §¬§à§Õ URI §Ñ§å§Õ§Ú§ä§à§â§Ú§Ú (§Ú§Õ§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§ä§à§â §ã§å§ë§ß§à§ã§ä§Ú SP): zabbix
    §°§Ò§â§Ñ§ä§Ú§ä§Ö §Ó§ß§Ú§Þ§Ñ§ß§Ú§Ö, §é§ä§à §ï§ä§à §Ù§ß§Ñ§é§Ö§ß§Ú§Ö §Ò§å§Õ§Ö§ä §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ä§î§ã§ñ §Ó §å§ä§Ó§Ö§â§Ø§Õ§Ö§ß§Ú§Ú SAML §Ü§Ñ§Ü §å§ß§Ú§Ü§Ñ§Ý§î§ß§í§Û §Ú§Õ§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§ä§à§â §á§à§ã§ä§Ñ§Ó§ë§Ú§Ü§Ñ §å§ã§Ý§å§Ô (§Ö§ã§Ý§Ú §ß§Ö §ã§à§Ó§á§Ñ§Õ§Ñ§Ö§ä, §à§á§Ö§â§Ñ§è§Ú§ñ §Ò§å§Õ§Ö§ä §à§ä§Ü§Ý§à§ß§Ö§ß§Ñ). §£ §ï§ä§à§Þ §á§à§Ý§Ö §Þ§à§Ø§ß§à §å§Ü§Ñ§Ù§Ñ§ä§î URL-§Ñ§Õ§â§Ö§ã §Ú§Ý§Ú §Ý§ð§Ò§å§ð §ã§ä§â§à§Ü§å §Õ§Ñ§ß§ß§í§ç.
  • C§à§ã§ä§à§ñ§ß§Ú§Ö §â§Ö§Ý§Ö §á§à §å§Þ§à§Ý§é§Ñ§ß§Ú§ð:
    §°§ã§ä§Ñ§Ó§î§ä§Ö §ï§ä§à §á§à§Ý§Ö §á§å§ã§ä§í§Þ; §Ö§ã§Ý§Ú §ä§â§Ö§Ò§å§Ö§ä§ã§ñ §ß§Ñ§ã§ä§â§Ñ§Ú§Ó§Ñ§Ö§Þ§í§Û §â§Ö§Õ§Ú§â§Ö§Ü§ä, §Ö§Ô§à §Þ§à§Ø§ß§à §Õ§à§Ò§Ñ§Ó§Ú§ä§î §Ó Áú»¢¶Ä²© §Ó §ß§Ñ§ã§ä§â§à§Û§Ü§Ñ§ç §¡§Õ§Þ§Ú§ß§Ú§ã§ä§â§Ú§â§à§Ó§Ñ§ß§Ú§Ö ¡ú §±§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§Ú.
  • §©§Ñ§á§à§Ý§ß§Ú§ä§Ö §à§ã§ä§Ñ§Ý§î§ß§í§Ö §á§à§Ý§ñ §Ó §ã§à§à§ä§Ó§Ö§ä§ã§ä§Ó§Ú§Ú §ã §Ó§Ñ§ê§Ú§Þ§Ú §á§â§Ö§Õ§á§à§é§ä§Ö§ß§Ú§ñ§Þ§Ú.

• §£ §â§Ñ§Ù§Õ§Ö§Ý§Ö §°§á§Ö§â§Ñ§ä§à§â§í §Ñ§ä§â§Ú§Ò§å§ä§à§Ó §Õ§à§Ò§Ñ§Ó§î§ä§Ö §Ó§í§â§Ñ§Ø§Ö§ß§Ú§Ö §ã §á§Ñ§â§Ñ§Þ§Ö§ä§â§Ñ§Þ§Ú:
  • Name: usrEmail
  • Name format: Unspecified
  • Value: user.email

6. §¯§Ñ §ã§Ý§Ö§Õ§å§ð§ë§Ö§Û §Ó§Ü§Ý§Ñ§Õ§Ü§Ö §Ó§í§Ò§Ö§â§Ú§ä§Ö "§Á §á§à§ã§ä§Ñ§Ó§ë§Ú§Ü §á§â§à§Ô§â§Ñ§Þ§Þ§ß§à§Ô§à §à§Ò§Ö§ã§á§Ö§é§Ö§ß§Ú§ñ. §Á §ç§à§é§å §Ú§ß§ä§Ö§Ô§â§Ú§â§à§Ó§Ñ§ä§î §ã§Ó§à§Ö §á§â§Ú§Ý§à§Ø§Ö§ß§Ú§Ö §ã Okta" §Ú §ß§Ñ§Ø§Þ§Ú§ä§Ö "§¤§à§ä§à§Ó§à".

7. §´§Ö§á§Ö§â§î §á§Ö§â§Ö§Û§Õ§Ú§ä§Ö §ß§Ñ §Ó§Ü§Ý§Ñ§Õ§Ü§å §±§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§Ú §Ú §ß§Ñ§Ø§Þ§Ú§ä§Ö §Ü§ß§à§á§Ü§å "§¯§Ñ§Ù§ß§Ñ§é§Ú§ä§î", §Ù§Ñ§ä§Ö§Þ §Ó§í§Ò§Ö§â§Ú§ä§Ö §¯§Ñ§Ù§ß§Ñ§é§Ú§ä§î §Ý§ð§Õ§ñ§Þ §Ú§Ù §â§Ñ§ã§Ü§â§í§Ó§Ñ§ð§ë§Ö§Ô§à§ã§ñ §ã§á§Ú§ã§Ü§Ñ.

8. §£§à §Ó§ã§á§Ý§í§Ó§Ñ§ð§ë§Ö§Þ §à§Ü§ß§Ö §ß§Ñ§Ù§ß§Ñ§é§î§ä§Ö §ã§à§Ù§Õ§Ñ§ß§ß§à§Ö §á§â§Ú§Ý§à§Ø§Ö§ß§Ú§Ö §Ý§ð§Õ§ñ§Þ, §Ü§à§ä§à§â§í§Ö §Ò§å§Õ§å§ä §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ä§î SAML 2.0 §Õ§Ý§ñ §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§Ú §Ó Áú»¢¶Ä²©, §Ù§Ñ§ä§Ö§Þ §ß§Ñ§Ø§Þ§Ú§ä§Ö "§³§à§ç§â§Ñ§ß§Ú§ä§î §Ú §Ó§Ö§â§ß§å§ä§î§ã§ñ".

9. §±§Ö§â§Ö§Û§Õ§Ú§ä§Ö §Ó §â§Ñ§Ù§Õ§Ö§Ý "§¦§Õ§Ú§ß§í§Û §Ó§ç§à§Õ" ¡ú "§±§â§à§ã§Þ§à§ä§â §Ú§ß§ã§ä§â§å§Ü§è§Ú§Û §á§à §ß§Ñ§ã§ä§â§à§Û§Ü§Ö". §ª§ß§ã§ä§â§å§Ü§è§Ú§Ú §á§à §å§ã§ä§Ñ§ß§à§Ó§Ü§Ö §Ò§å§Õ§å§ä §à§ä§à§Ò§â§Ñ§Ø§Ö§ß§í §Ó §ß§à§Ó§à§Û §Ó§Ü§Ý§Ñ§Õ§Ü§Ö; §Õ§Ö§â§Ø§Ú§ä§Ö §ï§ä§å §Ó§Ü§Ý§Ñ§Õ§Ü§å §à§ä§Ü§â§í§ä§à§Û §á§â§Ú §ß§Ñ§ã§ä§â§à§Û§Ü§Ö Áú»¢¶Ä²©.

§¯§Ñ§ã§ä§à§Û§Ü§Ñ Áú»¢¶Ä²©

1. §£ Áú»¢¶Ä²©, §á§Ö§â§Ö§Û§Õ§Ú§ä§Ö §Ó §ß§Ñ§ã§ä§â§à§Û§Ü§Ú SAML §Ó §â§Ñ§Ù§Õ§Ö§Ý§Ö §¡§Õ§Þ§Ú§ß§Ú§ã§ä§â§Ú§â§à§Ó§Ñ§ß§Ú§Ö ¡ú §¡§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§ñ §Ú §ã§Ü§à§á§Ú§â§å§Û§ä§Ö §Ú§ß§æ§à§â§Þ§Ñ§è§Ú§ð §Ú§Ù §Ú§ß§ã§ä§â§å§Ü§è§Ú§Û §á§à §ß§Ñ§ã§ä§â§à§Û§Ü§Ö Okta §Ó §ã§à§à§ä§Ó§Ö§ä§ã§ä§Ó§å§ð§ë§Ú§Ö §á§à§Ý§ñ:

• Identity Provider Single Sign-On URL ¡ú SSO service URL
• Identity Provider Issuer ¡ú IdP entity ID
• Username attribute ¡ú Attribute name (usrEmail)
• SP entity ID ¡ú Audience URI

2. §©§Ñ§Ô§â§å§Ù§Ú§ä§Ö §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä, §å§Ü§Ñ§Ù§Ñ§ß§ß§í§Û §ß§Ñ §ã§ä§â§Ñ§ß§Ú§è§Ö §Ú§ß§ã§ä§â§å§Ü§è§Ú§Û §á§à §ß§Ñ§ã§ä§â§à§Û§Ü§Ö Okta, §Ó §á§Ñ§á§Ü§å ui/conf/certs §Ü§Ñ§Ü idp.crt §Ú §å§ã§ä§Ñ§ß§à§Ó§Ú§ä§Ö §â§Ñ§Ù§â§Ö§ê§Ö§ß§Ú§Ö 644, §Ó§í§á§à§Ý§ß§Ú§Ó:

chmod 644 idp.crt

§°§Ò§â§Ñ§ä§Ú§ä§Ö §Ó§ß§Ú§Þ§Ñ§ß§Ú§Ö, §é§ä§à §Ö§ã§Ý§Ú §Ó§í §à§Ò§ß§à§Ó§Ú§Ý§Ú§ã§î §Õ§à Áú»¢¶Ä²© 5.0 §Ú§Ù §Ò§à§Ý§Ö§Ö §ã§ä§Ñ§â§à§Û §Ó§Ö§â§ã§Ú§Ú, §Ó§Ñ§Þ §ä§Ñ§Ü§Ø§Ö §ß§Ö§à§Ò§ç§à§Õ§Ú§Þ§à §Ó§â§å§é§ß§å§ð §Õ§à§Ò§Ñ§Ó§Ú§ä§î §ï§ä§Ú §ã§ä§â§à§Ü§Ú §Ó §æ§Ñ§Û§Ý zabbix.conf.php (§â§Ñ§ã§á§à§Ý§à§Ø§Ö§ß§ß§í§Û §Ó §Ü§Ñ§ä§Ñ§Ý§à§Ô§Ö ui/conf/):

// Used for SAML authentication.
       $SSO['SP_KEY'] = 'conf/certs/sp.key'; // Path to your private key.
       $SSO['SP_CERT'] = 'conf/certs/sp.crt'; // Path to your public key.
       $SSO['IDP_CERT'] = 'conf/certs/idp.crt'; // Path to IdP public key.
       $SSO['SETTINGS'] = []; // Additional settings

§³§Þ. §à§Ò§ë§Ú§Ö §Ú§ß§ã§ä§â§å§Ü§è§Ú§Ú §¡§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§ñ SAML §Õ§Ý§ñ §á§à§Ý§å§é§Ö§ß§Ú§ñ §Õ§à§á§à§Ý§ß§Ú§ä§Ö§Ý§î§ß§í§ç §ã§Ó§Ö§Õ§Ö§ß§Ú§Û. 3. §¦§ã§Ý§Ú §º§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö §å§ä§Ó§Ö§â§Ø§Õ§Ö§ß§Ú§Û §Ò§í§Ý§à §å§ã§ä§Ñ§ß§à§Ó§Ý§Ö§ß§à §ß§Ñ §º§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö §Ó Okta, §æ§Ý§Ñ§Ø§à§Ü ?§µ§ä§Ó§Ö§â§Ø§Õ§Ö§ß§Ú§ñ? §á§Ñ§â§Ñ§Þ§Ö§ä§â§Ñ §º§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö §ä§Ñ§Ü§Ø§Ö §Õ§à§Ý§Ø§Ö§ß §Ò§í§ä§î §à§ä§Þ§Ö§é§Ö§ß §Ó Áú»¢¶Ä²©.

4. §¯§Ñ§Ø§Þ§Ú§ä§Ö §Ü§ß§à§á§Ü§å "§°§Ò§ß§à§Ó§Ú§ä§î", §é§ä§à§Ò§í §ã§à§ç§â§Ñ§ß§Ú§ä§î §ï§ä§Ú §ß§Ñ§ã§ä§â§à§Û§Ü§Ú.