Skip to content

Enable per-user authentication in Zabbix plugin based on Grafana user identity #2016

@FrancescoCoco

Description

@FrancescoCoco

Is your feature request related to a problem? Please describe.
I'm often frustrated when all Grafana users are forced to use the same Zabbix API token for data source queries, regardless of their identity. This limits per-user access control and auditability, especially in environments with centralized authentication like LDAP.

Describe the solution you'd like
I would like the Zabbix plugin for Grafana to support per-user API token authentication, dynamically tied to the logged-in Grafana user. When a user logs into Grafana, the plugin should:

Use the Grafana username (e.g., from LDAP) to look up the corresponding user in Zabbix.

If the user exists in Zabbix:

Check for an existing API token.

If a token exists, use it.

If not, generate a new token using an admin-level authenticator token.

Use the resulting API token to perform data queries in Zabbix as that user.

If the user does not exist in Zabbix, the data source should not work for that user, and a proper error message should be returned.

Describe alternatives you've considered

Sharing a single service account API token for all users, which prevents proper access control.

Manually mapping API tokens to users, which is unmanageable at scale.

Creating a proxy or middleware to handle user mapping, which adds unnecessary complexity and maintenance overhead.

Additional context
This feature would allow Grafana to seamlessly integrate with Zabbix in LDAP-authenticated environments, enabling fine-grained, auditable access control. It aligns with the principle of least privilege and enhances security and user accountability.

Metadata

Metadata

Assignees

No one assigned

    Projects

    Status

    Backlog

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions