This is a pure bash-script for syncing a Actice-Directory Group via LDAP with a Zabbix-Group
Changelog:
-o ldif-wrap=no
to prevent line breaks after 79 charsäöü!?>$%
and spacesdsquery user -samid name_of_the_user
Output should something like
CN=ldapSearch,OU=MyUsers,DC=exampledomain,DC=local
where ldapSearch is the example-user
Create one or more Active Directory Groups and add Members. Empty Groups are allowed (then all members in Zabbix will be removed from Group and disabled). I suggest Groups for
In the examples i am using the groupname Zabbix-Super-Admin
Yes, i am using pure bash to avoid any prerequisites but we need a program for accessing LDAP and some other tools. All of them should be available in the standard repositories:
Debian/Ubuntu
apt install ldap-utils
Red Hat/CentOs/SuSe
yum install openldap-clients
The other needed programs are
curl
sed
dirname
readlink
which should be already installed
It should be a non LDAP user with Frontend acccess internal
(defined by Group Membership)
The User must have the User type Zabbix Super Admin
for creating new users and changing group memberships.
Also avoid special chars in username and password.
In the examples i am using the username zabbixapiuser
At least 2 groups are required:
Target Group for Users:
This Group must have Frontend access LDAP
and should be enabled.
In the examples i am using the groupname Zabbix-Super-Admin
Target Group for Disabled Users:
The build-in Group Disabled can be used.
Or create a new group which is not enabled (remove checkox) and Frontend access Disabled
In the examples i am using the groupnameLDAP-Disabled
Check the Settings for LDAP:
Administration => Authentication => LDAP settings
I suggest to uncheck the Case sensitive login checkbox. The script compares the Windows SAMAccountnames
and the Zabbix Alias
case insensitive.
With this settings, the user can log in with manfred
, Manfred
and MaNfReD
and the sync script will find and use the existing user.
I installed the script on the Zabbix-Server in a separate folder.
Login to Zabbix-Server and move to the root path of the ExternalScripts
and AlertScriptsPath
folder,
the default path is (Debian/Ubuntu/CentOS)
cd /usr/lib/zabbix/
Clone this repository, it will create a new folder named zabbix-ldap-sync-bash
:
git clone https://github.com/BernhardLinz/zabbix-ldap-sync-bash.git
Change to the new directory:
cd zabbix-ldap-sync-bash
Make the two *.sh
scripts executeable:
chmod +x *.sh
The script zabbix-ldap-sync.sh
is looking for the config.sh
in the same folder (if no config-file is specified).
Just make a copy of the config-example.sh
cp config-example.sh config.sh
Open the file config.sh
with an editor and set the needed values:
nano config .sh
LDAP_Source_URL="ldaps://172.16.0.10"
Should be ldap
or ldaps
, use name or IP-Address of a domain controller.
LDAP_Ignore_SSL_Certificate="true"
If set to true
the SSL-Certificate for LDAPS will be ignored. Set to false
to validate the certificates.
LDAP_Bind_User_DN="CN=ldapSearch,OU=MyUsers,DC=exampledomain,DC=local"
LDAP_Bind_User_Password="9qA3XB1r##Xr27c1HPpq"
The distinguished name for the user which was created in Step 1. Prepare Active Directory
LDAP_SearchBase="DC=exampledomain,DC=local"
The domain name or organisation unit
LDAP_Groupname_for_Sync="Zabbix-Super-Admin"
ZABBIX_Groupname_for_Sync="LDAP-SuperAdmin"
Change Zabbix-Super-Admin
to your Active Directory-Groupname and LDAP-SuperAdmin
to the target Zabbix-Groupname.
ZABBIX_Disabled_User_Group="LDAP-Disabled"
Name of the Group for Disabled Users. The Group must have the Enabled checkbox unchecked or the group will not found. Every user who is removed from the group ZABBIX_Groupname_for_Sync becomes a member of this group. The reason is that a user must always be a member of at least one group in Zabbix.
ZABBIX_API_URL="http://localhost/api_jsonrpc.php"
ZABBIX_API_User="zabbixapiuser"
ZABBIX_API_Password="strongpassword73#"
The ZABBIX_API_URL is path to the Zabbix webinterface. Can be http://
or https://
, the certificate validation will be ignored.
Depending on the Zabbix installation, /api_jsonrpc.php
or /zabbix/api_jsonrpc.php
must be used.
ZABBIX_UserType_User=3
up to Zabbix 5.0.x there are 3 bultin Types, 1,2 or 3 from Zabbix 5.2.x there are User Rules. There are 3 predefined user roles which correspond to the pevious user types. but you can define additional user roles in Zabbix and use here The bultin Types (<=5.0.x) or predefined Roles (>=5.2.x) are 1 = Zabbix User 2 = Zabbix Admin 3 = Zabbix Super Admin The script will not update existing zabbix-users. You can check the ID of the RoleId in the webinterface
Administration => User roles => click the name of the role
At the end of the URL you see roleid=1
with the needed ID
ZABBIX_MediaTypeID="1"
1 is Email at new installations. Will be used for new created users if the mail property is not empty (Microsoft Exchange will fill theses property automatically with the sender-address). You can check the ID of the MediaType in the webinterface
Administration => Media types => click the name of the Media
At the end of the URL you see mediatypeid=1
with the needed ID
./zabbix-ldap-sync.sh
You should get some output like this:
---------------------------------------------------------------------------
zabbix-ldap-sync.sh (Version V1.2 (2021-01-10)) startup
Checking prerequisites ............................................... done
Searching config file ................................................ done
Reading "/usr/lib/zabbix/zabbix-ldap-sync-bash/config-znil.sh" ....... done
Check all needed Settings ............................................ done
STEP 1: Getting all Members from Active Directory / LDAP Group ....... done
Query sAMAccountName, sn, givenName and primary Email-Address ........ done
Check Zabbix API Version ............................................. done
Using User mode ...................................................... roleid
Login at Zabbix API .................................................. done
STEP 2: Get Members of Zabbix-LDAP Groups ............................ checking
determine UsrGrpID of "LDAP-SuperAdmin" .............................. done
determine UsrGrpID of "LDAP-Disabled" ................................ done
determine alias and userid for Members of "LDAP-SuperAdmin" .......... done
STEP 3: Compare Groups for changes ................................... checking
Check 1: Number of Users LDAP ........................................ 4
Check 1: Number of Users Zabbix ...................................... 1
Check 1: Number of Users ............................................. not equal
STEP 4: Get all Zabbix Users with alias and userid ................... done
STEP 5: Compare LDAP user with existing Zabbix User .................. must create 3 new user
STEP 6: Create needed 3 new Zabbix-User .............................. done
STEP 7: Replace Members of Group LDAP-SuperAdmin ..................... done
STEP 8: Get List of all disabled user in Group LDAP-Disabled ......... done
STEP 9: Remove active user, add inactive user ........................ done
STEP 10: Replace Members of Group LDAP-Disabled ...................... done
STEP 11: Replace Members of Group LDAP-SuperAdmin (2. Time) .......... done
Logout Zabbix API .................................................... done
If there is an error with Login to LDAP or Zabbix an Error Message will be displayed. Check Output for more.
Try
./zabbix-ldap-sync.sh -v
for verbose mode with a lot of Output. You will see all ldapsearch
and curl
calls with parameter. Passwords are hidden with Stars.
If you want to see the passwords also try
./zabbix-ldap-sync.sh -v -p
-c | -C | --config use a specific configuration file instead config.sh
-v | -V | --verbose Display debugging information, include all commands
-p | -P | --ShowPassword Show the passwords in the verbose output
-s | -S | --silent Hide all Output except errors. Usefull with crontab
Just create a separate config file for each group combination:
config.sh
to a new name like zabbix-readonly.conf
(the extension doesn't matter)run the script like this
./zabbix-ldap-sync.sh -c zabbix-readonly.conf Do not sync different LDAP-Groups with the same Zabbix-Group! The last sync will win! Make the users only to a member of one of these groups. If the user is removed from one of the groups, the user will be disabled.
Test the sync in the shell with full paths like
/usr/lib/zabbix/zabbix-ldap-sync-bash/zabbix-ldap-sync.sh -c /usr/lib/zabbix/zabbix-ldap-sync-bash/zabbix-readonly.conf
Just add the line to crontab like
*/10 * * * * /usr/lib/zabbix/zabbix-ldap-sync-bash/zabbix-ldap-sync.sh -c /usr/lib/zabbix/zabbix-ldap-sync-bash/zabbix-readonly.conf -s
for syncing every 10 minutes Add a line to crontab for each group/configuration you want to sync
Change to the Script folder and just type
git pull
The zabbix-ldap-sync.sh
and the ´config-example.sh´ maybe overwritten with the new versions.
Your existing files will not be touched or deleted.