Contact UsGet started
© 2025 Direct Cursus Technology L.L.C.

Creating a SAML app in Yandex Identity Hub for integration with Zabbix

Written by
Updated at November 12, 2025

Note

This feature is at the Preview stage.

Zabbix is an open-source, enterprise-level monitoring system for tracking the performance and health of servers, networks, apps, and other IT resources. Zabbix supports SAML authentication to provide secure SSO for your organization's users.

To authenticate your organization's users to Zabbix via SAML SSO, create a SAML app in Identity Hub and configure it appropriately both in Identity Hub and Zabbix.

SAML apps can be managed by users with the organization-manager.samlApplications.admin role or higher.

For the users of your organization to be able to access Zabbix:

  1. Create an app.
  2. Set up the integration.
  3. Make sure the application works correctly.

Create an app

  1. Log in to Yandex Identity Hub.
  2. In the left-hand panel, select Apps.
  3. In the top-right corner, click Create application and in the window that opens:

    1. Select the SAML (Security Assertion Markup Language) single sign-on method.

    2. In the Name field, specify a name for your new app: zabbix-app.

    3. Optionally, in the Description field, enter a description for the new app.

    4. Optionally, add labels:

      1. Click Add label.
      2. Enter a label in key: value format.
      3. Press Enter.

    5. Click Create application.

Set up the integration

To integrate Zabbix with the SAML app you created in Identity Hub, complete the setup both on the Zabbix side and in Identity Hub.

Set up the SAML application in Zabbix

Note

To set up the SAML application in Zabbix, the user needs the Super admin role.

Configure SAML authentication in Zabbix

  1. To configure SAML authentication in Zabbix, in the left-hand panel, navigate to Users and then to Authentication.

  2. In the main window, go to the SAML Settings tab. After the form opens, complete the steps below:

    1. Activate the Enable SAML authentication option.

    2. Activate the Enable JIT provisioning option.

      Note

      Enable JIT provisioning controls automatic creation of users in Zabbix when authenticating with SSO. If this option is disabled, only users who already have a Zabbix account will be able to authenticate.

    3. Configure a link between Zabbix and Identity Hub:

      1. Log in to Yandex Identity Hub.

      2. In the left-hand panel, select Apps and then, the SAML app.

      3. Under Identity provider (IdP) configuration, in the Overview tab, copy the following field values: Issuer / IdP EntityID, Login URL, and Logout URL.

      4. Return to Zabbix and paste the copied addresses into these fields: IdP entity ID, SSO service URL, and SLO service URL.

        Note

        If you do not specify the address in SLO service URL, on logout of Zabbix, the user will be redirected to the Zabbix authentication form, not the Identity Hub authentication form.

    4. In the Username attribute field, specify login.

      Note

      This attribute is used as username when authenticating in Zabbix. You can specify any attribute name you want, but it must match the name of the user attribute which has the SubjectClaims.preferred_username value in your Identity Hub app.

    5. In the SP entity ID field, specify zabbix.

      Warning

      The SP entity ID value must be exactly the same in both Zabbix and your Identity Hub application.

    6. In the Sign and Encrypt sections, leave all options disabled.

      Tip

      Yandex Identity Hub does not currently support request signature verification, so we recommend you leave the Sign and Encrypt section options disabled.

    7. Enable the Case-sensitive login option if you want the login to be case-sensitive.

    8. If the Enable JIT provisioning option is on, configure the automatic user creation settings in Zabbix. To do this, enable the Configure JIT provisioning option and follow these steps:

      1. In the Group name attribute field, specify groups: this attribute defines a user group in your Identity Hub app, which provides access to Zabbix.

      2. In the User name attribute field, enter givenname.

      3. In the User last name attribute field, enter surname.

      4. Under User group mapping, map your Identity Hub app's user group to the appropriate group and role in Zabbix. This will enable new users to automatically get their assigned group and role in Zabbix. To do this, click Add and follow these steps:

        1. In the SAML group pattern field, specify a pattern to search for SAML app group names.

          Note

          The SAML group pattern field supports wildcard characters with *.

        2. In the User groups field, specify the Zabbix groups to which new users will be automatically added on their first authentication.

        3. In the User role field, specify the Zabbix role to assign to users when they first log in.

      5. Optionally, under Media type mapping, configure mapping of your SAML app’s user attributes to receive notifications from Zabbix.

      6. Leave the Enable SCIM provisioning option disabled.

        Tip

        Currently, Yandex Identity Hub does not support the SCIM protocol for automatic user management in other apps, so we recommend leaving the Enable SCIM provisioning option disabled.

  3. In the main window, go to the Authentication tab. After the form opens, in the Deprovisioned users group field, select the Disabled group.

    Warning

    If the Enable JIT provisioning option is on, you must specify the Deprovisioned users group on the Authentication tab. This group is where deactivated users will be moved.

  4. Save the settings by clicking Update.

Migrate the SAML app certificate and configure Zabbix

To migrate the SAML app certificate and configure Zabbix, follow these steps:

  1. Download the identity provider (IdP) certificate:

    1. Log in to Yandex Identity Hub.
    2. In the left-hand panel, select Apps and then, the SAML app.
    3. On the Overview tab, under Application certificate, click Download certificate and save the file to your device.

  2. Copy the resulting certificate file to the /usr/share/zabbix/ui/conf/certs folder on the Zabbix server.

  3. Configure access permissions.

    chmod 644 /usr/share/zabbix/ui/conf/certs/<your_cert>.crt

  4. Open the /usr/share/zabbix/ui/conf/zabbix.conf.php Zabbix configuration file and specify the path to the IdP certificate.

    $SSO['IDP_CERT'] = 'conf/certs/<your_cert>.crt';

Set up the SAML application in Yandex Identity Hub

Set up service provider endpoints

  1. Log in to Yandex Identity Hub.
  2. In the left-hand panel, select Apps and then, the SAML app.
  3. At the top right, click Edit and in the window that opens:
    1. In the **SP EntityID ** field, specify zabbix.
    2. In the ACS URL field, enter this address: https://<your-domain>/zabbix/index_sso.php?acs.
    3. Click Save.

Configure user attributes

Warning

For integration with Zabbix, users must have the login attribute.

If users do not have the login attribute, add it:

  1. Log in to Yandex Identity Hub.

  2. In the left-hand panel, select Apps and select the desired app.

  3. Navigate to the Attributes tab.

  4. In the top-right corner, click Add attribute and in the window that opens:

    1. In the Attribute name field, enter login.
    2. In the Value field, select SubjectClaims.preferred_username.
    3. Click Add.

If you have configured automatic user creation in Zabbix, add the user group attribute. Proceed as follows:

  1. In the top-right corner, click Add group attribute and in the window that opens.
  2. In the Attribute name field, specify groups.
  3. In the Transmitted groups field, select Assigned groups only.
  4. Click Add.

For more information about configuring attributes, see Configure user and group attributes.

Add users

For your organization's users to be able to authenticate in Zabbix with Identity Hub's SAML app, you need to explicitly add these users and/or user groups to the SAML app:

Note

Users and groups added to a SAML application can be managed by a user with the organization-manager.samlApplications.userAdmin role or higher.

  1. If you have configured automatic user creation in Zabbix, create the relevant group:

    1. Log in to Yandex Identity Hub.
    2. In the left-hand panel, select Groups.
    3. In the top-right corner of the page, click Create group.
    4. Enter the name: zabbix-users.
    5. Click Create group.
    6. Add users to the group:
      1. Navigate to the Members tab.
      2. Click Add member.
      3. In the window that opens, select the required users.
      4. Click Save.

  2. Add users to the application:

    1. Log in to Yandex Identity Hub.
    2. In the left-hand panel, select Apps and select the required app.
    3. Navigate to the Users and groups tab.
    4. Click Add users.
    5. In the window that opens, select the required user or user group.
    6. Click Add.

Make sure your application works correctly

To make sure both your SAML app and Zabbix integration work correctly, authenticate to Zabbix as one of the users you added to the app. Proceed as follows:

  1. In your browser, navigate to the address of your Zabbix instance, e.g., https://<your-domain>/zabbix/.
  2. If you were logged in to Zabbix, log out.
  3. On the Zabbix authentication page, click Sign in with Single Sign-On (SAML).
  4. On the Yandex Cloud authentication page, enter your email address and user password. The user or group they belong to must be added to the application.
  5. Make sure you are logged in to Zabbix.
Previous
OpenID Connect
Next
Yandex 360