Áú»¢¶Ä²©

3. §¡§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§ñ

§°§Ò§Ù§à§â

§£ §â§Ñ§Ù§Õ§Ö§Ý§Ö §¡§Õ§Þ§Ú§ß§Ú§ã§ä§â§Ú§â§à§Ó§Ñ§ß§Ú§Ö ¡ú §¡§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§ñ §Þ§à§Ø§ß§à §Ù§Ñ§Õ§Ñ§ä§î §Ô§Ý§à§Ò§Ñ§Ý§î§ß§í§Û §Þ§Ö§ä§à§Õ §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§Ú §Ó Áú»¢¶Ä²© §Ú §ä§â§Ö§Ò§à§Ó§Ñ§ß§Ú§ñ §Ü §á§Ñ§â§à§Ý§ð. §¥§à§ã§ä§å§á§ß§í §ã§Ý§Ö§Õ§å§ð§ë§Ú§Ö §Þ§Ö§ä§à§Õ§í §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§Ú: §Ó§ß§å§ä§â§Ö§ß§ß§Ú§Û, HTTP, LDAP §Ú SAML.

§¡§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§ñ §á§à §å§Þ§à§Ý§é§Ñ§ß§Ú§ð

§±§à §å§Þ§à§Ý§é§Ñ§ß§Ú§ð Áú»¢¶Ä²© §Ú§ã§á§à§Ý§î§Ù§å§Ö§ä §Ó§ß§å§ä§â§Ö§ß§ß§ð§ð §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§ð Áú»¢¶Ä²© §Õ§Ý§ñ §Ó§ã§Ö§ç §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§Ö§Û. §®§à§Ø§ß§à §Ú§Ù§Þ§Ö§ß§Ú§ä§î §Þ§Ö§ä§à§Õ §á§à §å§Þ§à§Ý§é§Ñ§ß§Ú§ð §ß§Ñ LDAP §Õ§Ý§ñ §Ó§ã§Ö§Û §ã§Ú§ã§ä§Ö§Þ§í §Ú§Ý§Ú §Ó§Ü§Ý§ð§é§Ú§ä§î §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§ð LDAP §ä§à§Ý§î§Ü§à §Õ§Ý§ñ §Ü§à§ß§Ü§â§Ö§ä§ß§í§ç §Ô§â§å§á§á §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§Ö§Û.

§¹§ä§à§Ò§í §å§ã§ä§Ñ§ß§à§Ó§Ú§ä§î LDAP §Ó §Ü§Ñ§é§Ö§ã§ä§Ó§Ö §Þ§Ö§ä§à§Õ§Ñ §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§Ú §á§à §å§Þ§à§Ý§é§Ñ§ß§Ú§ð §Õ§Ý§ñ §Ó§ã§Ö§ç §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§Ö§Û, §á§Ö§â§Ö§Û§Õ§Ú§ä§Ö §Ü §Ó§Ü§Ý§Ñ§Õ§Ü§Ö LDAP §Ú §ß§Ñ§ã§ä§â§à§Û§ä§Ö §á§Ñ§â§Ñ§Þ§Ö§ä§â§í §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§Ú, §Ù§Ñ§ä§Ö§Þ §Ó§Ö§â§ß§Ú§ä§Ö§ã§î §ß§Ñ §Ó§Ü§Ý§Ñ§Õ§Ü§å §¡§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§ñ §Ú §å§ã§ä§Ñ§ß§à§Ó§Ú§ä§Ö §á§Ö§â§Ö§Ü§Ý§ð§é§Ñ§ä§Ö§Ý§î §¡§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§ñ §á§à §å§Þ§à§Ý§é§Ñ§ß§Ú§ð §Ó §á§à§Ý§à§Ø§Ö§ß§Ú§Ö LDAP.

§°§Ò§â§Ñ§ä§Ú§ä§Ö §Ó§ß§Ú§Þ§Ñ§ß§Ú§Ö, §é§ä§à §Þ§Ö§ä§à§Õ §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§Ú §Þ§à§Ø§ß§à §ä§à§é§ß§à §ß§Ñ§ã§ä§â§à§Ú§ä§î §ß§Ñ §å§â§à§Ó§ß§Ö §Ô§â§å§á§á §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§Ö§Û. §¥§Ñ§Ø§Ö §Ö§ã§Ý§Ú §Ô§Ý§à§Ò§Ñ§Ý§î§ß§à §ß§Ñ§ã§ä§â§à§Ö§ß§Ñ §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§ñ LDAP, §ß§Ö§Ü§à§ä§à§â§í§Ö §Ô§â§å§á§á§í §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§Ö§Û §á§à-§á§â§Ö§Ø§ß§Ö§Þ§å §Þ§à§Ô§å§ä §á§â§à§ç§à§Õ§Ú§ä§î §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§ð §ã§â§Ö§Õ§ã§ä§Ó§Ñ§Þ§Ú Áú»¢¶Ä²©. §µ §ï§ä§Ú§ç §Ô§â§å§á§á §Õ§à§ã§ä§å§á §Ü §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã§å §Õ§à§Ý§Ø§Ö§ß §Ò§í§ä§î §Ó§í§ã§ä§Ñ§Ó§Ý§Ö§ß §Ü§Ñ§Ü §£§ß§å§ä§â§Ö§ß§ß§Ú§Û. §ª §ß§Ñ§à§Ò§à§â§à§ä, §Ö§ã§Ý§Ú §Ô§Ý§à§Ò§Ñ§Ý§î§ß§à §Ú§ã§á§à§Ý§î§Ù§å§Ö§ä§ã§ñ §Ó§ß§å§ä§â§Ö§ß§ß§ñ§ñ §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§ñ, §á§à§Õ§â§à§Ò§ß§à§ã§ä§Ú §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§Ú LDAP §Þ§à§Ø§ß§à §å§Ü§Ñ§Ù§Ñ§ä§î §Ú §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ä§î §Õ§Ý§ñ §Ü§à§ß§Ü§â§Ö§ä§ß§í§ç §Ô§â§å§á§á §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§Ö§Û, §é§Ö§Û §Õ§à§ã§ä§å§á §Ü §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã§å §ß§Ñ§ã§ä§â§à§Ö§ß §Ü§Ñ§Ü LDAP. §¦§ã§Ý§Ú §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§î §Ó§ç§à§Õ§Ú§ä §ç§à§ä§ñ §Ò§í §Ó §à§Õ§ß§å §Ô§â§å§á§á§å §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§Ö§Û §ã §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§Ö§Û LDAP, §ä§à §ï§ä§à§ä §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§î §ß§Ö §ã§Þ§à§Ø§Ö§ä §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ä§î §Þ§Ö§ä§à§Õ §Ó§ß§å§ä§â§Ö§ß§ß§Ö§Û §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§Ú.

§®§Ö§ä§à§Õ§í §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§Ú HTTP §Ú SAML 2.0 §Þ§à§Ô§å§ä §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ä§î§ã§ñ §Ó §Õ§à§á§à§Ý§ß§Ö§ß§Ú§Ö §Ü §Þ§Ö§ä§à§Õ§Ñ§Þ §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§Ú §á§à §å§Þ§à§Ý§é§Ñ§ß§Ú§ð.

§£§ß§å§ä§â§Ö§ß§ß§ñ§ñ §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§ñ

§£§Ü§Ý§Ñ§Õ§Ü§Ñ §¡§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§ñ §á§à§Ù§Ó§à§Ý§ñ§Ö§ä §à§á§â§Ö§Õ§Ö§Ý§Ú§ä§î §ß§Ñ§ã§ä§â§Ñ§Ú§Ó§Ñ§Ö§Þ§í§Ö §ä§â§Ö§Ò§à§Ó§Ñ§ß§Ú§ñ §Ü §ã§Ý§à§Ø§ß§à§ã§ä§Ú §á§Ñ§â§à§Ý§ñ §Õ§Ý§ñ §Ó§ß§å§ä§â§Ö§ß§ß§Ú§ç §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§Ö§Û Áú»¢¶Ä²©.

§®§à§Ø§ß§à §ß§Ñ§ã§ä§â§à§Ú§ä§î §ã§Ý§Ö§Õ§å§ð§ë§Ú§Ö §á§Ñ§â§Ñ§Þ§Ö§ä§â§í §á§à§Ý§Ú§ä§Ú§Ü§Ú §á§Ñ§â§à§Ý§Ö§Û:

§ª§Ù§Þ§Ö§ß§Ö§ß§Ú§ñ §Ó §ä§â§Ö§Ò§à§Ó§Ñ§ß§Ú§ñ§ç §Ü §ã§Ý§à§Ø§ß§à§ã§ä§Ú §á§Ñ§â§à§Ý§ñ §ß§Ö §á§à§Ó§Ý§Ú§ñ§ð§ä §ß§Ñ §ã§å§ë§Ö§ã§ä§Ó§å§ð§ë§Ú§Ö §á§Ñ§â§à§Ý§Ú §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§Ö§Û, §ß§à §Ö§ã§Ý§Ú §ã§å§ë§Ö§ã§ä§Ó§å§ð§ë§Ú§Û §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§î §â§Ö§ê§Ú§ä §Ú§Ù§Þ§Ö§ß§Ú§ä§î §á§Ñ§â§à§Ý§î, §ä§à §ß§à§Ó§í§Û §á§Ñ§â§à§Ý§î §Õ§à§Ý§Ø§Ö§ß §ã§à§à§ä§Ó§Ö§ä§ã§ä§Ó§à§Ó§Ñ§ä§î §ä§Ö§Ü§å§ë§Ú§Þ §ä§â§Ö§Ò§à§Ó§Ñ§ß§Ú§ñ§Þ. §±§à§Õ§ã§Ü§Ñ§Ù§Ü§Ñ §ã§à §ã§á§Ú§ã§Ü§à§Þ §ä§â§Ö§Ò§à§Ó§Ñ§ß§Ú§Û §Ò§å§Õ§Ö§ä §à§ä§à§Ò§â§Ñ§Ø§Ñ§ä§î§ã§ñ §â§ñ§Õ§à§Þ §ã §á§à§Ý§Ö§Þ §±§Ñ§â§à§Ý§î §Ó §á§â§à§æ§Ú§Ý§Ö §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§ñ §Ú §Ó §Õ§Ú§Ñ§Ý§à§Ô§Ö §ß§Ñ§ã§ä§â§à§Û§Ü§Ú §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§ñ, §Õ§à§ã§ä§å§á§ß§à§Þ §Ú§Ù §Þ§Ö§ß§ð §¡§Õ§Þ§Ú§ß§Ú§ã§ä§â§Ú§â§à§Ó§Ñ§ß§Ú§Ö¡ú§±§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§Ú.

§¡§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§ñ HTTP

§¥§Ý§ñ §á§â§à§Ó§Ö§â§Ü§Ú §Ú§Þ§×§ß §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§Ö§Û §Ú §á§Ñ§â§à§Ý§Ö§Û §Þ§à§Ø§ß§à §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ä§î §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§ð §ß§Ñ §à§ã§ß§à§Ó§Ö HTTP §Ú§Ý§Ú §Ó§Ö§Ò-§ã§Ö§â§Ó§Ö§â§Ñ (§ß§Ñ§á§â§Ú§Þ§Ö§â: §Ò§Ñ§Ù§à§Ó§Ñ§ñ §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§ñ, NTLM/Kerberos). §°§Ò§â§Ñ§ä§Ú§ä§Ö §Ó§ß§Ú§Þ§Ñ§ß§Ú§Ö, §é§ä§à §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§î §ä§Ñ§Ü§Ø§Ö §Õ§à§Ý§Ø§Ö§ß §ã§å§ë§Ö§ã§ä§Ó§à§Ó§Ñ§ä§î §Ó Áú»¢¶Ä²©; §à§Õ§ß§Ñ§Ü§à, §Ö§Ô§à §á§Ñ§â§à§Ý§î Áú»¢¶Ä²© §ß§Ö §Ò§å§Õ§Ö§ä §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ä§î§ã§ñ.

§±§Ñ§â§Ñ§Þ§Ö§ä§â§í §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§Ú:

§±§Ñ§â§Ñ§Þ§Ö§ä§â	§°§á§Ú§ã§Ñ§ß§Ú§Ö
§¡§Ü§ä§Ú§Ó§Ñ§è§Ú§ñ HTTP §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§Ú (Enable HTTP authentication)	§°§ä§Þ§Ö§ä§î§ä§Ö §æ§Ý§Ñ§Ø§à§Ü, §é§ä§à§Ò§í §Ó§Ü§Ý§ð§é§Ú§ä§î §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§ð HTTP. §±§â§Ú §ß§Ñ§Ó§Ö§Õ§Ö§ß§Ú§Ú §å§Ü§Ñ§Ù§Ñ§ä§Ö§Ý§ñ §Þ§í§ê§Ú §ß§Ñ §á§à§ñ§Ó§Ú§ä§ã§ñ §á§à§Õ§ã§Ü§Ñ§Ù§Ü§Ñ §ã §á§â§Ö§Õ§å§á§â§Ö§Ø§Õ§Ö§ß§Ú§Ö§Þ, §é§ä§à §Ó §ã§Ý§å§é§Ñ§Ö §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§Ú §Ó§Ö§Ò-§ã§Ö§â§Ó§Ö§â§Ñ §Ó§ã§Ö §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§Ú (§Õ§Ñ§Ø§Ö §ã §Õ§à§ã§ä§å§á§à§Þ §Ü §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã§å, §å§ã§ä§Ñ§ß§à§Ó§Ý§Ö§ß§ß§à§Þ§å §Ó LDAP/§Ó§ß§å§ä§â§Ö§ß§ß§Ú§Û) §Ò§å§Õ§å§ä §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§è§Ú§â§à§Ó§Ñ§ä§î§ã§ñ §Ó§Ö§Ò-§ã§Ö§â§Ó§Ö§â§à§Þ, §Ñ §ß§Ö §ã§Ö§â§Ó§Ö§â§à§Þ Áú»¢¶Ä²©.
§¥§Ú§Ñ§Ý§à§Ô §Ó§ç§à§Õ§Ñ §Ó §ã§Ú§ã§ä§Ö§Þ§å §á§à §å§Þ§à§Ý§é§Ñ§ß§Ú§ð (Default login form)	§µ§Ü§Ñ§Ø§Ú§ä§Ö, §ã§Ý§Ö§Õ§å§Ö§ä §Ý§Ú §ß§Ñ§á§â§Ñ§Ó§Ý§ñ§ä§î §ß§Ö§Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§è§Ú§â§à§Ó§Ñ§ß§ß§í§ç §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§Ö§Û §ß§Ñ: §¥§Ú§Ñ§Ý§à§Ô §Ó§ç§à§Õ§Ñ §Ó §ã§Ú§ã§ä§Ö§Þ§å Áú»¢¶Ä²© ¡ª §ã§ä§Ñ§ß§Õ§Ñ§â§ä§ß§å§ð §ã§ä§â§Ñ§ß§Ú§è§å §Ó§ç§à§Õ§Ñ Áú»¢¶Ä²©. HTTP §Õ§Ú§Ñ§Ý§à§Ô §Ó§ç§à§Õ§Ñ §Ó §ã§Ú§ã§ä§Ö§Þ§å ¡ª §ã§ä§â§Ñ§ß§Ú§è§å §Ó§ç§à§Õ§Ñ HTTP. §²§Ö§Ü§à§Þ§Ö§ß§Õ§å§Ö§ä§ã§ñ §Ó§Ü§Ý§ð§é§Ñ§ä§î §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§ð §ß§Ñ §à§ã§ß§à§Ó§Ö §Ó§Ö§Ò-§ã§Ö§â§Ó§Ö§â§Ñ §ä§à§Ý§î§Ü§à §Õ§Ý§ñ §ã§ä§â§Ñ§ß§Ú§è§í index_http.php. §¦§ã§Ý§Ú §Õ§Ý§ñ §¥§Ú§Ñ§Ý§à§Ô§Ñ §Ó§ç§à§Õ§Ñ §Ó §ã§Ú§ã§ä§Ö§Þ§å §á§à §å§Þ§à§Ý§é§Ñ§ß§Ú§ð §å§ã§ä§Ñ§ß§à§Ó§Ý§Ö§ß§à §Ù§ß§Ñ§é§Ö§ß§Ú§Ö ?HTTP §Õ§Ú§Ñ§Ý§à§Ô §Ó§ç§à§Õ§Ñ §Ó §ã§Ú§ã§ä§Ö§Þ§å?, §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§î §Ò§å§Õ§Ö§ä §Ó§ç§à§Õ§Ú§ä§î §Ó §ã§Ú§ã§ä§Ö§Þ§å §Ñ§Ó§ä§à§Þ§Ñ§ä§Ú§é§Ö§ã§Ü§Ú, §Ö§ã§Ý§Ú §Þ§à§Õ§å§Ý§î §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§Ú §Ó§Ö§Ò-§ã§Ö§â§Ó§Ö§â§Ñ §å§ã§ä§Ñ§ß§à§Ó§Ú§ä §Õ§Ö§Û§ã§ä§Ó§Ú§ä§Ö§Ý§î§ß§í§Û §Ý§à§Ô§Ú§ß §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§ñ §Ó §á§Ö§â§Ö§Þ§Ö§ß§ß§à§Û $_SERVER. §±§à§Õ§Õ§Ö§â§Ø§Ú§Ó§Ñ§Ö§Þ§í§Ö §Ü§Ý§ð§é§Ú $_SERVER: PHP_AUTH_USER, REMOTE_USER, AUTH_USER.
§µ§Õ§Ñ§Ý§Ö§ß§Ú§Ö §Ú§Þ§Ö§ß§Ú §Õ§à§Þ§Ö§ß§Ñ (Remove domain name)	§³§á§Ú§ã§à§Ü §Õ§à§Þ§Ö§ß§ß§í§ç §Ú§Þ§Ö§ß §é§Ö§â§Ö§Ù §Ù§Ñ§á§ñ§ä§å§ð, §Ü§à§ä§à§â§í§Ö §ã§Ý§Ö§Õ§å§Ö§ä §å§Õ§Ñ§Ý§Ú§ä§î §Ú§Ù §Ú§Þ§Ö§ß§Ú §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§ñ. §¯§Ñ§á§â§Ú§Þ§Ö§â: comp,any - §Ö§ã§Ý§Ú §Ú§Þ§ñ §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§ñ ?Admin@any? §Ú§Ý§Ú ?comp\Admin?, §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§î §Ó§à§Û§Õ§Ö§ä §Ó §ã§Ú§ã§ä§Ö§Þ§å §Ü§Ñ§Ü ?Admin?; §Ö§ã§Ý§Ú §Ú§Þ§ñ §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§ñ ?notacompany\Admin?, §Ó§ç§à§Õ §Ò§å§Õ§Ö§ä §Ù§Ñ§á§â§Ö§ë§×§ß.
§²§Ö§Ô§Ú§ã§ä§â§à§Ù§Ñ§Ó§Ú§ã§Ú§Þ§í§Û §Ó§ç§à§Õ (Case sensitive login)	§³§ß§Ú§Þ§Ú§ä§Ö §æ§Ý§Ñ§Ø§à§Ü, §é§ä§à§Ò§í §à§ä§Ü§Ý§ð§é§Ú§ä§î §Õ§Ý§ñ §Ú§Þ§Ö§ß §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§Ö§Û §Ó§ç§à§Õ §ã §å§é§×§ä§à§Þ §â§Ö§Ô§Ú§ã§ä§â§Ñ (§Ó§Ü§Ý§ð§é§×§ß§ß§í§Û §á§à §å§Þ§à§Ý§é§Ñ§ß§Ú§ð). §°§ä§Ü§Ý§ð§é§Ö§ß§Ú§Ö §Ó§ç§à§Õ§Ñ §ã §å§é§×§ä§à§Þ §â§Ö§Ô§Ú§ã§ä§â§Ñ §á§à§Ù§Ó§à§Ý§ñ§Ö§ä, §ß§Ñ§á§â§Ú§Þ§Ö§â, §Ó§à§Û§ä§Ú §Ó §ã§Ú§ã§ä§Ö§Þ§å §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§Ö§Þ ?admin?, §Õ§Ñ§Ø§Ö §Ö§ã§Ý§Ú §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§Ö§Þ Áú»¢¶Ä²© §ñ§Ó§Ý§ñ§Ö§ä§ã§ñ ?Admin? §Ú§Ý§Ú ?ADMIN?. §°§Ò§â§Ñ§ä§Ú§ä§Ö §Ó§ß§Ú§Þ§Ñ§ß§Ú§Ö, §é§ä§à §Ö§ã§Ý§Ú §Ó§ç§à§Õ §ã §å§é§×§ä§à§Þ §â§Ö§Ô§Ú§ã§ä§â§Ñ §à§ä§Ü§Ý§ð§é§×§ß §Ú §ã§å§ë§Ö§ã§ä§Ó§å§Ö§ä §ß§Ö§ã§Ü§à§Ý§î§Ü§à Áú»¢¶Ä²© §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§Ö§Û §ã §á§à§ç§à§Ø§Ú§Þ§Ú §Ú§Þ§Ö§ß§Ñ§Þ§Ú §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§Ö§Û (§ß§Ñ§á§â§Ú§Þ§Ö§â, Admin §Ú admin), §Ó§ç§à§Õ §Õ§Ý§ñ §ï§ä§Ú§ç §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§Ö§Û §Ó§ã§Ö§Ô§Õ§Ñ §Ò§å§Õ§Ö§ä §Ù§Ñ§á§â§Ö§ë§×§ß §ã§à §ã§Ý§Ö§Õ§å§ð§ë§Ú§Þ §ã§à§à§Ò§ë§Ö§ß§Ú§Ö§Þ §à§Ò §à§ê§Ú§Ò§Ü§Ö: ?Authentication failed: supplied credentials are not unique (§¡§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§ñ §ß§Ö §å§Õ§Ñ§Ý§Ñ§ã§î: §á§â§Ö§Õ§à§ã§ä§Ñ§Ó§Ý§Ö§ß§ß§í§Ö §å§é§×§ä§ß§í§Ö §Õ§Ñ§ß§ß§í§Ö §ß§Ö §å§ß§Ú§Ü§Ñ§Ý§î§ß§í)?.

§¡§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§ñ LDAP

§£§ß§Ö§ê§ß§ð§ð §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§ð LDAP §Þ§à§Ø§ß§à §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ä§î §Õ§Ý§ñ §á§â§à§Ó§Ö§â§Ü§Ú §Ú§Þ§×§ß §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§Ö§Û §Ú §á§Ñ§â§à§Ý§Ö§Û. §°§Ò§â§Ñ§ä§Ú§ä§Ö §Ó§ß§Ú§Þ§Ñ§ß§Ú§Ö, §é§ä§à §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§î §ä§Ñ§Ü§Ø§Ö §Õ§à§Ý§Ø§Ö§ß §ã§å§ë§Ö§ã§ä§Ó§à§Ó§Ñ§ä§î §Ó Áú»¢¶Ä²©, §à§Õ§ß§Ñ§Ü§à §Ö§Ô§à §á§Ñ§â§à§Ý§î Áú»¢¶Ä²© §ß§Ö §Ò§å§Õ§Ö§ä §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ä§î§ã§ñ.

§¡§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§ñ Áú»¢¶Ä²© LDAP §â§Ñ§Ò§à§ä§Ñ§Ö§ä §Ü§Ñ§Ü §Þ§Ú§ß§Ú§Þ§å§Þ §ã Microsoft Active Directory §Ú OpenLDAP.

§±§Ñ§â§Ñ§Þ§Ö§ä§â§í §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§Ú:

§¡§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§ñ SAML

§¥§Ý§ñ §Ó§ç§à§Õ§Ñ §Ó Áú»¢¶Ä²© §Þ§à§Ø§ß§à §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ä§î §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§ð SAML 2.0. §°§Ò§â§Ñ§ä§Ú§ä§Ö §Ó§ß§Ú§Þ§Ñ§ß§Ú§Ö, §é§ä§à §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§î §Õ§à§Ý§Ø§Ö§ß §ã§å§ë§Ö§ã§ä§Ó§à§Ó§Ñ§ä§î §Ó Áú»¢¶Ä²©, §à§Õ§ß§Ñ§Ü§à §Ö§Ô§à §á§Ñ§â§à§Ý§î Áú»¢¶Ä²© §ß§Ö §Ò§å§Õ§Ö§ä §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ä§î§ã§ñ. §¦§ã§Ý§Ú §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§ñ §á§â§à§ê§Ý§Ñ §å§ã§á§Ö§ê§ß§à, Áú»¢¶Ä²© §ã§à§á§à§ã§ä§Ñ§Ó§Ú§ä §Ý§à§Ü§Ñ§Ý§î§ß§à§Ö §Ú§Þ§ñ §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§ñ §ã §Ñ§ä§â§Ú§Ò§å§ä§à§Þ §Ú§Þ§Ö§ß§Ú §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§ñ, §Ó§à§Ù§Ó§â§Ñ§ë§Ñ§Ö§Þ§í§Þ SAML.

§¯§Ñ§ã§ä§â§à§Û§Ü§Ñ §á§à§ã§ä§Ñ§Ó§ë§Ú§Ü§Ñ §Ú§Õ§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§à§ß§ß§í§ç §Õ§Ñ§ß§ß§í§ç

§¥§Ý§ñ §â§Ñ§Ò§à§ä§í §ã Áú»¢¶Ä²©, §á§à§ã§ä§Ñ§Ó§ë§Ú§Ü§Ñ §Ú§Õ§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§à§ß§ß§í§ç §Õ§Ñ§ß§ß§í§ç SAML (, , §Ú §ä.§Õ.) §ß§Ö§à§Ò§ç§à§Õ§Ú§Þ§à §ß§Ñ§ã§ä§â§à§Ú§ä§î §ã§Ý§Ö§Õ§å§ð§ë§Ú§Þ §à§Ò§â§Ñ§Ù§à§Þ:

• §µ§ä§Ó§Ö§â§Ø§Õ§Ö§ß§Ú§Ö §±§à§ä§â§Ö§Ò§Ú§ä§Ö§Ý§ñ URL (Assertion Consumer URL) §Õ§à§Ý§Ø§ß§à §Ò§í§ä§î §å§ã§ä§Ñ§ß§à§Ó§Ý§Ö§ß§à §Ó &±ô³Ù;§á§å§ä§î³å§Ü³å§Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã§å³å³ú²¹²ú²ú¾±³æ&²µ³Ù;/¾±²Ô»å±ð³æ³å²õ²õ´Ç.±è³ó±è?²¹³¦²õ
• §¦§Õ§Ú§ß§í§Û URL-§Ñ§Õ§â§Ö§ã §Ó§í§ç§à§Õ§Ñ (Single Logout URL) §Õ§à§Ý§Ø§Ö§ß §Ò§í§ä§î §å§ã§ä§Ñ§ß§à§Ó§Ý§Ö§ß §Ó &±ô³Ù;§á§å§ä§î³å§Ü³å§Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã§å³å³ú²¹²ú²ú¾±³æ&²µ³Ù;/¾±²Ô»å±ð³æ³å²õ²õ´Ç.±è³ó±è?²õ±ô²õ

§±§â§Ú§Þ§Ö§â§í &±ô³Ù;§á§å§ä§Ú³å§Ü³å§Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã§å³å³ú²¹²ú²ú¾±³æ&²µ³Ù;: <https://example.com/zabbix/ui>,<http://another.example.com/zabbix>,<http://><any\_public\_ip\_address>/zabbix

§¯§Ñ§ã§ä§â§à§Û§Ü§Ñ Áú»¢¶Ä²©

§¥§Ý§ñ §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ß§Ú§ñ §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§Ú SAML Áú»¢¶Ä²© §Õ§à§Ý§Ø§Ö§ß §Ò§í§ä§î §ß§Ñ§ã§ä§â§à§Ö§ß §ã§Ý§Ö§Õ§å§ð§ë§Ú§Þ §à§Ò§â§Ñ§Ù§à§Þ:

1. §©§Ñ§Ü§â§í§ä§í§Û §Ü§Ý§ð§é (private key) §Ú §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä §Õ§à§Ý§Ø§ß§í §ç§â§Ñ§ß§Ú§ä§î§ã§ñ §Ó ui/conf/certs/, §Ö§ã§Ý§Ú §ä§à§Ý§î§Ü§à §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§î§ã§Ü§Ú§Ö §á§å§ä§Ú §ß§Ö §å§Ü§Ñ§Ù§Ñ§ß§í §Ó §æ§Ñ§Û§Ý§Ö zabbix.conf.php.

§±§à §å§Þ§à§Ý§é§Ñ§ß§Ú§ð, Áú»¢¶Ä²© §Ò§å§Õ§Ö§ä §Ú§ã§Ü§Ñ§ä§î §Ó §ã§Ý§Ö§Õ§å§ð§ë§Ú§ç §Þ§Ö§ã§ä§Ñ§ç:

• ui/conf/certs/sp.key ¡ª §æ§Ñ§Û§Ý §Ù§Ñ§Ü§â§í§ä§à§Ô§à §Ü§Ý§ð§é§Ñ SP
• ui/conf/certs/sp.crt ¡ª §æ§Ñ§Û§Ý §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§Ñ SP
• ui/conf/certs/idp.crt ¡ª §æ§Ñ§Û§Ý §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§Ñ IDP

2. §£§ã§Ö §ß§Ñ§Ú§Ò§à§Ý§Ö§Ö §Ó§Ñ§Ø§ß§í§Ö §ß§Ñ§ã§ä§â§à§Û§Ü§Ú §Þ§à§Ô§å§ä §Ò§í§ä§î §ã§Õ§Ö§Ý§Ñ§ß§í §é§Ö§â§Ö§Ù §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã Áú»¢¶Ä²©. §°§Õ§ß§Ñ§Ü§à, §Ó §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§à§ß§ß§à§Þ §æ§Ñ§Û§Ý§Ö §Þ§à§Ø§ß§à §å§Ü§Ñ§Ù§Ñ§ä§î §Õ§à§á§à§Ý§ß§Ú§ä§Ö§Ý§î§ß§í§Ö §ß§Ñ§ã§ä§â§à§Û§Ü§Ú.

§±§Ñ§â§Ñ§Þ§Ö§ä§â§í §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§Ú, §Õ§à§ã§ä§å§á§ß§í§Ö §Ó §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã§Ö Áú»¢¶Ä²©:

§²§Ñ§ã§ê§Ú§â§Ö§ß§ß§í§Ö §ß§Ñ§ã§ä§â§à§Û§Ü§Ú

§¥§à§á§à§Ý§ß§Ú§ä§Ö§Ý§î§ß§í§Ö §á§Ñ§â§Ñ§Þ§Ö§ä§â§í SAML §Þ§à§Ø§ß§à §ß§Ñ§ã§ä§â§à§Ú§ä§î §Ó §æ§Ñ§Û§Ý§Ö §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§Ú §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã§Ñ Áú»¢¶Ä²© (zabbix.conf.php):

• $SSO['SP_KEY'] = '<§á§å§ä§î §Ü §æ§Ñ§Û§Ý§å §Ù§Ñ§Ü§â§í§ä§à§Ô§à §Ü§Ý§ð§é§Ñ SP>';
• $SSO['SP_CERT'] = '<§á§å§ä§î §Ü §æ§Ñ§Û§Ý§å §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§Ñ SP>';
• $SSO['IDP_CERT'] = '<§á§å§ä§î §Ü §æ§Ñ§Û§Ý§å §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§Ñ IDP>';
• $SSO['SETTINGS']

§£ §â§Ñ§Þ§Ü§Ñ§ç $SSO['SETTINGS'] §Þ§à§Ø§ß§à §Ù§Ñ§Õ§Ñ§ä§î §ä§à§Ý§î§Ü§à §ã§Ý§Ö§Õ§å§ð§ë§Ú§Ö §á§Ñ§â§Ñ§Þ§Ö§ä§â§í:

• strict
• baseurl
• compress
• contactPerson
• organization
• sp (§ä§à§Ý§î§Ü§à §à§á§è§Ú§Ú, §å§Ü§Ñ§Ù§Ñ§ß§ß§í§Ö §Ó §ï§ä§à§Þ §ã§á§Ú§ã§Ü§Ö)
  • attributeConsumingService
  • x509certNew
• idp (§ä§à§Ý§î§Ü§à §à§á§è§Ú§Ú, §å§Ü§Ñ§Ù§Ñ§ß§ß§í§Ö §Ó §ï§ä§à§Þ §ã§á§Ú§ã§Ü§Ö)
  • singleLogoutService (§ä§à§Ý§î§Ü§à §à§Õ§ß§Ñ §à§á§è§Ú§ñ)
    • responseUrl
  • certFingerprint
  • certFingerprintAlgorithm
  • x509certMulti
• security (§ä§à§Ý§î§Ü§à §à§á§è§Ú§Ú, §å§Ü§Ñ§Ù§Ñ§ß§ß§í§Ö §Ó §ï§ä§à§Þ §ã§á§Ú§ã§Ü§Ö)
  • signMetadata
  • wantNameId
  • requestedAuthnContext
  • requestedAuthnContextComparison
  • wantXMLValidation
  • relaxDestinationValidation
  • destinationStrictlyMatches
  • rejectUnsolicitedResponsesWithInResponseTo
  • signatureAlgorithm
  • digestAlgorithm
  • lowercaseUrlencoding

§£§ã§Ö §à§ã§ä§Ñ§Ý§î§ß§í§Ö §á§Ñ§â§Ñ§Þ§Ö§ä§â§í §Ò§å§Õ§å§ä §Ó§Ù§ñ§ä§í §Ú§Ù §Ò§Ñ§Ù§í §Õ§Ñ§ß§ß§í§ç §Ú §ß§Ö §Þ§à§Ô§å§ä §Ò§í§ä§î §á§Ö§â§Ö§à§á§â§Ö§Õ§Ö§Ý§Ö§ß§í. §°§á§è§Ú§ñ debug §Ò§å§Õ§Ö§ä §Ú§Ô§ß§à§â§Ú§â§à§Ó§Ñ§ä§î§ã§ñ.

§¬§â§à§Þ§Ö §ä§à§Ô§à, §Ö§ã§Ý§Ú §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§î§ã§Ü§Ú§Û §Ú§ß§ä§Ö§â§æ§Ö§Û§ã Áú»¢¶Ä²© §ß§Ñ§ç§à§Õ§Ú§ä§ã§ñ §Ù§Ñ §á§â§à§Ü§ã§Ú-§ã§Ö§â§Ó§Ö§â§à§Þ §Ú§Ý§Ú §Ò§Ñ§Ý§Ñ§ß§ã§Ú§â§à§Ó§ë§Ú§Ü§à§Þ §ß§Ñ§Ô§â§å§Ù§Ü§Ú, §Þ§à§Ø§ß§à §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ä§î §á§à§Ý§î§Ù§à§Ó§Ñ§ä§Ö§Ý§î§ã§Ü§å§ð §à§á§è§Ú§ð use_proxy_headers:

• false (§á§à §å§Þ§à§Ý§é§Ñ§ß§Ú§ð) - §Ú§Ô§ß§à§â§Ú§â§à§Ó§Ñ§ä§î §ï§ä§å §à§á§è§Ú§ð;
• true - §Õ§Ý§ñ §á§à§ã§ä§â§à§Ö§ß§Ú§ñ §Ò§Ñ§Ù§à§Ó§à§Ô§à URL §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ä§î HTTP-§Ù§Ñ§Ô§à§Ý§à§Ó§Ü§Ú X-Forwarded-*.

§¦§ã§Ý§Ú §Ó§í §Ú§ã§á§à§Ý§î§Ù§å§Ö§ä§Ö §Ò§Ñ§Ý§Ñ§ß§ã§Ú§â§à§Ó§ë§Ú§Ü §ß§Ñ§Ô§â§å§Ù§Ü§Ú §Õ§Ý§ñ §á§à§Õ§Ü§Ý§ð§é§Ö§ß§Ú§ñ §Ü §ï§Ü§Ù§Ö§Þ§á§Ý§ñ§â§å Áú»¢¶Ä²©, §Ô§Õ§Ö §Ò§Ñ§Ý§Ñ§ß§ã§Ú§â§à§Ó§ë§Ú§Ü §ß§Ñ§Ô§â§å§Ù§Ü§Ú §Ú§ã§á§à§Ý§î§Ù§å§Ö§ä TLS/SSL, §Ñ Áú»¢¶Ä²© ¡ª §ß§Ö§ä, §Ó§í §Õ§à§Ý§Ø§ß§í §å§Ü§Ñ§Ù§Ñ§ä§î §á§Ñ§â§Ñ§Þ§Ö§ä§â§í ?baseurl?, ?strict? §Ú ?use_proxy_headers? §ã§Ý§Ö§Õ§å§ð§ë§Ú§Þ §à§Ò§â§Ñ§Ù§à§Þ:

$SSO['SETTINGS'] = [
           'strict' => false,
           'baseurl' => 'https://zabbix.example.com/zabbix/',
           'use_proxy_headers' => true
       ];

§±§â§Ú§Þ§Ö§â §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§Ú:

$SSO['SETTINGS'] = [
           'security' => [
               'signatureAlgorithm' => 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384'
               'digestAlgorithm' => 'http://www.w3.org/2001/04/xmldsig-more#sha384',
               // ...
           ],
           // ...
       ];

§¯§Ñ§ã§ä§â§à§Û§Ü§Ñ §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã§Ñ §ã Kerberos/ADFS

§®§à§Ø§ß§à §Ú§ã§á§à§Ý§î§Ù§à§Ó§Ñ§ä§î §æ§Ñ§Û§Ý §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú§Ú §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã§Ñ Áú»¢¶Ä²© (zabbix.conf.php), §é§ä§à§Ò§í §ß§Ñ§ã§ä§â§à§Ú§ä§î SSO §ã §Ñ§å§ä§Ö§ß§ä§Ú§æ§Ú§Ü§Ñ§è§Ú§Ö§Û Kerberos §Ú ADFS:

$SSO['SETTINGS'] = [
           'security' => [
               'requestedAuthnContext' => [
                   'urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos',
               ],
               'requestedAuthnContextComparison' => 'exact'
           ]
       ]; 

§£ §ï§ä§à§Þ §ã§Ý§å§é§Ñ§Ö, §Ó §ß§Ñ§ã§ä§â§à§Û§Ü§Ñ§ç SAML §Ó §á§à§Ý§Ö ID §à§Ò§ì§Ö§Ü§ä§Ñ SP (SP name ID) §Ù§Ñ§Õ§Ñ§Û§ä§Ö:

urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified