Zabbix and Active Directory with JIT Provisioning

In the previous video, we connected Zabbix to Active Directory using LDAP and let AD handle user authentication.

But there was still one part missing! 😄

We still had to create users inside Zabbix and manage some of their settings manually.

This is where JIT Provisioning comes in.

In this video, we take the Active Directory integration one step further. This time, we use JIT Provisioning and also configure User Group Mapping and Media Mapping.

What Is JIT Provisioning?

JIT stands for Just-In-Time.

The idea is pretty simple. When a user logs in to Zabbix with their Active Directory account, Zabbix can automatically provision that user based on the information coming from AD.

So we don't have to create every user manually in Zabbix before they can log in.

The user logs in, and Zabbix takes care of the rest based on our JIT configuration.

Less manual work is always welcome! 😄

User Group Mapping

Now that users can be provisioned automatically, we have another question:

Which Zabbix User Group should they belong to?

This is where User Group Mapping comes in.

We can map Active Directory groups to User Groups in Zabbix.

For example, imagine we have this group in Active Directory:

Zabbix-Admins

We can configure Zabbix so that members of this AD group are automatically mapped to the appropriate Zabbix User Group.

We can do the same thing for other teams and groups.

This makes user management much cleaner because we can manage group membership from Active Directory instead of manually assigning every user inside Zabbix.

Media Mapping

The next useful feature is Media Mapping.

Active Directory doesn't just store usernames and groups. It can also contain information such as a user's email address or phone number.

With Media Mapping, we can take these attributes from Active Directory and use them as Media information in Zabbix.

For example, if the user's email address is already stored in AD, we can map it to their Email Media in Zabbix and use it for notifications.

No need to enter the same email address again.

It's already in Active Directory, so let's just use it! 😄

What Do We Have in the End?

With JIT enabled, the integration between Zabbix and Active Directory becomes much more useful.

In the previous video, we mainly had:

Active Directory → Authentication

Now we have:

Active Directory → Authentication → JIT Provisioning → Group Mapping → Media Mapping

So Active Directory can handle authentication, Zabbix can provision users when they log in, AD groups can determine their Zabbix User Groups, and user information can be mapped to Zabbix Media.

In this video, I configure all of this step by step and show how JIT Provisioning, User Group Mapping, and Media Mapping work with Zabbix and Active Directory.

If you watched the previous video, this is basically the next step. This time, we're just letting Active Directory do a little more of the work for us! 😄