4.4 KiB

Raw Permalink Blame History

title	sidebar_label
Integrate with Observium	Observium

Observium

Support level: Community

What is Observium

Observium is a network monitoring and management platform that provides real-time insight into network health and performance.

-- https://observium.org

:::note This is based on authentik 2024.6.0 and Observium CE 24.4.13528 :::

Preparation

The following placeholders will be used:

observium.company is the FQDN of the Observium install.
authentik.company is the FQDN of the authentik install.

This guide assumes you already have a working Observium instance. It is recommended to install it with the install script, following the instructions on Observium's website.

Apache2 comes bundled with Observium, but there is also a third party module, mod_auth_openidc, which is needed for this configuration to work. Download the latest release of the project suitable for your machine.

This guide uses libapache2-mod-auth-openidc_2.4.15.7-1.bookworm_amd64.deb as an example.

Install the package:

apt install ./libapache2-mod-auth-openidc_2.4.15.7-1.bookworm_amd64.deb

authentik configuration

In authentik, under Providers, create an OAuth2/OpenID Provider with these settings:
- Name: Observium
- Client ID: Copy this for later
- Client Secret: Copy this for later
- Redirect URIs/Origins: https://observium.company/secure/redirect_uri (This can be any location on the domain that doesn't point to actual content)
- Signing Key: Select any available signing key
In authentik, under Applications, create an Application with these settings:
- Name: Observium
- Slug: observium
- Provider: Select Observium

Observium configuration

Edit the file /etc/apache2/sites-available/000-default.conf and add the following lines:

<VirtualHost *:80>
    ...

    OIDCProviderMetadataURL https://authentik.company/application/o/observium/.well-known/openid-configuration
    OIDCClientID <Client ID>
    OIDCClientSecret <Client Secret>
    OIDCRedirectURI https://observium.company/secure/redirect_uri
    OIDCCryptoPassphrase <Random string for security>
    OIDCCookieDomain observium.company
    OIDCXForwardedHeaders X-Forwarded-Host X-Forwarded-Proto
    OIDCPathScope "openid email profile"
    OIDCRemoteUserClaim preferred_username ^(.*)$ $1@authentik

    <Location />
    AuthType openid-connect
    Require valid-user
    </Location>

    ...
</VirtualHost>

Meaning of variables:

OIDCRedirectURI is the same URI that is set for the authentik Provider.
The OIDCCryptoPassphrase directive should be set to a random string, for more information, see the official documentation.
OIDCXForwardedHeaders is necessary if your instance is behind a reverse proxy. If omitted, the module does not accept information from these headers.
OIDCRemoteUserClaim tells the module how to construct a username based on your claims. The first argument selects the claim, while the second and third are RegEx search and replace expressions. More info

Edit the Observium configuration. By default, it should be located at /opt/observium/config.php.

Edit the following line:
```
$config['auth_mechanism'] = "remote";
```
Add the following lines:
```
$config['auth_remote_userlevel'] = 10;
$config['auth_remote_logout_url'] = "https://authentik.company/application/o/observium/end-session/";
```
With this method, you can only assign one permission level to all users. Since Observium permits only a single authentication mechanism to be selected, it is recommended to set auth_remote_userlevel to 10. You can read about all of the user levels here.
Restart the Apache2 service:
```
service apache2 restart
```
Now you should be able to log in to your Observium instance using authentik.

4.4 KiB Raw Permalink Blame History