Introduction

This guide is a walkthrough to set up a BrowZer application to access Zabbix.

Naming Conventions

In this document, you may see the following acronyms, phrases, or words. This explains what they represent in a general way.

Zero Trust: “The main concept behind zero trust is “never trust, always verify,” which means that devices should not be trusted by default, even if they are connected to a managed corporate network such as the corporate LAN and even if they were previously verified.” (Wikipedia)
Ziti SDK: Zero Trust Software Development Kit created by NetFoundry which is an interface to a ZITI network. The ZITI SDK enables easy application modification (pre-compile) to augment the way the application requests access to resources it requires to perform work. ZITI SDKs and associated ZITI-enabled applications are completely open-source works on GitHub. AKA - THE FUTURE!
Service Policy (AppWan): A Service Policy (AppWan) is a policy group of Identities (Endpoints) that shall be able to access other identities (Endpoints) that provide services.
Console: The Cloud Ziti NPaaS, a multitenant, cloud solution that customers of NetFoundry utilize to manipulate, augment, create, and destroy elements of a ZITI network.
VPN: Virtual Private Network: A mechanism of many different methods that transports data on behalf of an application running on a CLIENT device. It is generally designed to extend private networks over public infrastructure and normally includes security protocols to protect it while doing so. VPNs were not designed with Zero Trust in mind as they must be heavily augmented to protect private services from unauthorized access to services by even authenticated devices/users. AKA - THE OLD WAY!
BrowZer: A group of Ziti components that work in concert to enable and facilitate clientless browser access to web servers that are dark on the internet.
Zabbix: an open-source suite of integrated business applications that includes modules for various business needs such as IT operations management (ITOM), IT service management (ITSM) network device management, Network monitoring, Bandwidth Graph/CPU/memory management, and more.

Prerequisites

A Cloud Ziti Network is up and running.
Having a Zabbix instance up and running with an edge router. We use the Ubuntu 22.04 setup. Please follow the Appendix instructions to install the Zabbix instance and autonomous edge router. In this example document, the edge router is named Zabbix-er.
In this example, the Zabbix server uses the default port 80. Make sure that the same port is used to configure the Ziti services.

Deployment

Part 1: Setup Needed Items to Support a BrowZer Application

Architecture diagram:

In this section:

Create a WSS-enabled NetFoundry Hosted Edge Router
Create an Edge Router Policy
Create the Service
Create a Service Policy

In the Console, create a NetFoundry Hosted Edge Router with the WSS Listener enabled. BrowZer requires at least one Edge Router with the WSS Listener enabled. Launching an NF Hosted is recommended.

In the Console, Create an Edge Router Policy to ensure this router is available for your Identities (Endpoints).

Create Service

In the Console, Create the Service that you want to access Zabbix. We recommend using an advanced service.

For the forward address use the Zabbix private IP of the eth0 interface. In My case, I use the 10.0.0.7. Put any FQDN for intercept IP.

Note: For the case of docker-compose, the forward address uses the docker Container IP or container name.

The PORT will be the default port on the Zabbix server. In our example, use port 80.

Note: For TLS/HTTPS testing use port 443 instead of 80.

Identities are the edge router zabbix-er.
Leave the default check yes to Forward Port.

Service Policy

In the Console, Create a Service Policy(AppWan) to allow access to the specified clients that we’ll create later.

Part 2: Auth0 & JWT Signer

In this section:

Create an Auth0 Account
Create an Auth0 Application(SPA)
Gather Information from Auth0 needed
Create a new JWT Signer
Create a new Authentication Policy
Create or update the Identities(Endpoints)

This tutorial follows the Auth0 settings. Other IDPs must have their own settings. If you don't already have an account you can sign up for a free account at https://auth0.com/signup

Adding a new Application in Auth0

Once you have an account setup you can add a new "Application":

Then click on the "Create Application":

Then Create a "Single Page Web Application":

Gathering Information from Auth0

To set up the new JWT Signer we'll need to get some information from the new Auth0 Application that was just created.

From the Application, we’ll require a few things we’ll need to write down. From the basic Information, we’ll gather the “Domain” and “ClientID”

Scroll down to the Advanced Settings and click on Endpoints

You’ll also need to write down the OAuth Token URL that will be used on the BrowZer App creation and the JSON Web Key Set.

Adding the callback & logout URL to your BrowZer App(s) you created

All BrowZer Apps have the following template:

https://<APP_NAME>.<NET_NAME>.browzer.cloudziti.io

where:

APP_NAME, is the name we’ll assign to the BrowZer app we’ll create.
NET_NAME, is the name we’ll assign the first time you click on “BrowZer Apps”.

In Auth0, under the Application/Settings you'll find "Allowed Callback URLs" & "Allowed Logout URLs"

You can add one callback URL for all apps created under the same NET_NAME In this case, NET_NAME=solarapp. The URL needs to be in this format: https://*.<NET_NAME>.browzer.cloudziti.io

For example:

 https://*.solarapp.browzer.cloudziti.io

For Example:

Put the same URLs under the "Allowed Logout URLs" also.

Adding a JWT Signer & Authentication Policy

Create the JWT

In the Console, Create a new JWT Signer

Using the values from Auth0 fill out the information in the new JWT Signer dialog.

For the ISSUER, use the “Domain” value.

https://<Domain>/

(Please make sure to add the trailing slash).

For the Audience, use the “ClientID” value.

For the JWKS Endpoint, use the "JSON Web Key Set URL" value.

For the External Auth URL, use the "OAUTH Token URL" value.

Finally set the JWT Claim "email" & the Identities to "External Id".

Create the Authentication Policy

In the Console, Create a new Authentication Policy

In this example, we disable the certificate options & only use the JWT Signer as the Authenticator.

Create or Assign Identities(Endpoints) to the Authentication Policy

In the Console, Create or update the Identities(Endpoints) that will have access to BrowZer. Please ensure you have added the necessary attributes you define in your Service Policy(AppWan) to the Identities(Endpoints) so it’ll have access to the service.

Finally, make sure it has an Authentication Policy you created for BrowZer

Part 3: The BrowZer Application

In this section:

BrowZer Getting Started
Create a new BrowZer Application
Access the Application

Make sure to complete the BrowZer Getting Started by clicking on the BrowZer Apps in the navigation menu.

Create a BrowZer Application

In the MOP Console, Create a new BrowZer Application.

For the App Entry, Select the service you created in Part 1.

For the Public URL, you’ll set a name for your app (APP_NAME), this name creates the whole URL you’ll use to access your service securely. In this case, APP_NAME=private-app, and the URL is

For example:

https://zabbix.solarapp.browzer.cloudziti.io

Set the OIDC Base URL to the “Domain” value from Auth0 in Part2, in the format:

https://<domain>

(This time without any slash at the end)

Set the ClientID to the "ClientId" value you got from Auth0 in Part 2.

Access your Application

The URL access is the one you got in the previous step. For this tutorial, the URL is:

https://zabbix.solarapp.browzer.cloudziti.io

After the authentication with the Google email that is set up in the endpoint authentication policy, you will be connected to the Zabbix landing page. If this is your first time connecting to the page, you will be presented with the following screen.

now click on login with username/password.

Accessing the Browzer-based Zabbix using TLS:

Follow the appendix to install the https-based configuration to access the Zabbix.

Enable the following options in the Browzer app to access the TLS-based Zabbix URL.

APPENDIX

Create Your Own Zabbix Instance

Note: Min 8GB RAM and 2 CPUs are required to run the docker-compose. else setup will not work.

Note, it is possible the Zabbix installation below does not install mysql server correctly. Please install mysql server by using "sudo apt install mysql-server" (alternately, you can follow this article to install mariadb:
To install Zabbix click here
After the first web login complete the initial setup using the created SQL username and password. Once the initial set up completes, log in with the username "Admin" and password "zabbix"

Note: You have to wait for 1 or 2 minutes after entering the command(zcat /usr/share/zabbix-sql-scripts/mysql/server.sql.gz | mysql --default-character-set=utf8mb4 -uzabbix -p zabbix) and password in step c "

Install TLS/SSL certificate to access using HTTPS/443(Optional):

sudo openssl req -new -newkey rsa:2048 -nodes -keyout domain.com.key -out domain.com.csr
sudo a2ensite default-ssl.conf
sudo a2enmod ssl
sudo systemctl reload apache2

Accessing Zabbix with BrowZer
Follow

Introduction

Naming Conventions

Prerequisites

Deployment

Part 1: Setup Needed Items to Support a BrowZer Application

Create Service

Service Policy

Part 2: Auth0 & JWT Signer

Adding a new Application in Auth0

Gathering Information from Auth0

Adding the callback & logout URL to your BrowZer App(s) you created

Adding a JWT Signer & Authentication Policy

Create the JWT

Create the Authentication Policy

Create or Assign Identities(Endpoints) to the Authentication Policy

Part 3: The BrowZer Application

Create a BrowZer Application

Access your Application

Accessing the Browzer-based Zabbix using TLS:

APPENDIX

Create Your Own Zabbix Instance

Install TLS/SSL certificate to access using HTTPS/443(Optional):

Install Autonomous Router

Comments

Accessing Zabbix with BrowZer Follow

Introduction

Naming Conventions

Prerequisites

Deployment

Part 1: Setup Needed Items to Support a BrowZer Application

Create Service

Service Policy

Part 2: Auth0 & JWT Signer

Adding a new Application in Auth0

Gathering Information from Auth0

Adding the callback & logout URL to your BrowZer App(s) you created

Adding a JWT Signer & Authentication Policy

Create the JWT

Create the Authentication Policy

Create or Assign Identities(Endpoints) to the Authentication Policy

Part 3: The BrowZer Application

Create a BrowZer Application

Access your Application

Accessing the Browzer-based Zabbix using TLS:

APPENDIX

Create Your Own Zabbix Instance

Install TLS/SSL certificate to access using HTTPS/443(Optional):

Install Autonomous Router

Articles in this section

Comments

Accessing Zabbix with BrowZer
Follow