d111740f6b
* website/integrations: all: install -> installation * fix for new integr Signed-off-by: 4d62 <git@sdko.org> --------- Signed-off-by: 4d62 <git@sdko.org>
114 lines
4.4 KiB
Markdown
114 lines
4.4 KiB
Markdown
---
|
|
title: Integrate with Observium
|
|
sidebar_label: Observium
|
|
---
|
|
|
|
# Observium
|
|
|
|
<span class="badge badge--secondary">Support level: Community</span>
|
|
|
|
## What is Observium
|
|
|
|
> Observium is a network monitoring and management platform that provides real-time insight into network health and performance.
|
|
>
|
|
> -- https://observium.org
|
|
|
|
:::note
|
|
This is based on authentik 2024.6.0 and Observium CE 24.4.13528
|
|
:::
|
|
|
|
## Preparation
|
|
|
|
The following placeholders are used in this guide:
|
|
|
|
- `observium.company` is the FQDN of the Observium installation.
|
|
- `authentik.company` is the FQDN of the authentik installation.
|
|
|
|
This guide assumes you already have a working Observium instance. It is recommended to install it with the install script, following the [instructions](https://docs.observium.org/) on Observium's website.
|
|
|
|
Apache2 comes bundled with Observium, but there is also a third party module, [mod_auth_openidc](https://github.com/OpenIDC/mod_auth_openidc), which is needed for this configuration to work.
|
|
Download the latest [release](https://github.com/OpenIDC/mod_auth_openidc/releases) of the project suitable for your machine.
|
|
|
|
This guide uses `libapache2-mod-auth-openidc_2.4.15.7-1.bookworm_amd64.deb` as an example.
|
|
|
|
Install the package:
|
|
|
|
```bash
|
|
apt install ./libapache2-mod-auth-openidc_2.4.15.7-1.bookworm_amd64.deb
|
|
```
|
|
|
|
## authentik configuration
|
|
|
|
1. In authentik, under **Providers**, create an **OAuth2/OpenID Provider** with these settings:
|
|
|
|
- Name: Observium
|
|
- Client ID: Copy this for later
|
|
- Client Secret: Copy this for later
|
|
- Redirect URIs/Origins: `https://observium.company/secure/redirect_uri` (This can be any location on the domain that doesn't point to actual content)
|
|
- Signing Key: Select any available signing key
|
|
|
|
2. In authentik, under **Applications**, create an Application with these settings:
|
|
|
|
- Name: Observium
|
|
- Slug: observium
|
|
- Provider: Select `Observium`
|
|
|
|
## Observium configuration
|
|
|
|
1. Edit the file `/etc/apache2/sites-available/000-default.conf` and add the following lines:
|
|
|
|
```apacheconf
|
|
<VirtualHost *:80>
|
|
...
|
|
|
|
OIDCProviderMetadataURL https://authentik.company/application/o/observium/.well-known/openid-configuration
|
|
OIDCClientID <Client ID>
|
|
OIDCClientSecret <Client Secret>
|
|
OIDCRedirectURI https://observium.company/secure/redirect_uri
|
|
OIDCCryptoPassphrase <Random string for security>
|
|
OIDCCookieDomain observium.company
|
|
OIDCXForwardedHeaders X-Forwarded-Host X-Forwarded-Proto
|
|
OIDCPathScope "openid email profile"
|
|
OIDCRemoteUserClaim preferred_username ^(.*)$ $1@authentik
|
|
|
|
<Location />
|
|
AuthType openid-connect
|
|
Require valid-user
|
|
</Location>
|
|
|
|
...
|
|
</VirtualHost>
|
|
```
|
|
|
|
Meaning of variables:
|
|
|
|
- `OIDCRedirectURI` is the same URI that is set for the authentik Provider.
|
|
- The `OIDCCryptoPassphrase` directive should be set to a random string, for more information, see [the official documentation](https://github.com/OpenIDC/mod_auth_openidc/blob/9c0909af71eb52283f4d3797e55d1efef64966f2/auth_openidc.conf#L15).
|
|
- `OIDCXForwardedHeaders` is necessary if your instance is behind a reverse proxy. If omitted, the module does not accept information from these headers.
|
|
- `OIDCRemoteUserClaim` tells the module how to construct a username based on your claims. The first argument selects the claim, while the second and third are RegEx search and replace expressions. [More info](https://github.com/OpenIDC/mod_auth_openidc/blob/9c0909af71eb52283f4d3797e55d1efef64966f2/auth_openidc.conf#L794)
|
|
|
|
2. Edit the Observium configuration. By default, it should be located at `/opt/observium/config.php`.
|
|
|
|
Edit the following line:
|
|
|
|
```php
|
|
$config['auth_mechanism'] = "remote";
|
|
```
|
|
|
|
Add the following lines:
|
|
|
|
```php
|
|
$config['auth_remote_userlevel'] = 10;
|
|
$config['auth_remote_logout_url'] = "https://authentik.company/application/o/observium/end-session/";
|
|
```
|
|
|
|
With this method, you can only assign one permission level to all users. Since Observium permits only a single authentication mechanism to be selected, it is recommended to set `auth_remote_userlevel` to 10. You can read about all of the user levels [here](https://docs.observium.org/user_levels/).
|
|
|
|
3. Restart the Apache2 service:
|
|
|
|
```bash
|
|
service apache2 restart
|
|
```
|
|
|
|
Now you should be able to log in to your Observium instance using authentik.
|