This release roundup brings together Icinga Web SSO v1.0.0, Icinga Director v1.11.9, and Icinga vSphere® Integration v1.8.4. It introduces OpenID Connect single sign-on for Icinga Web and includes compatibility updates for the upcoming Icinga PHP Library 1.0.0 release.
Icinga Web SSO v1.0.0
OpenID Connect support has been one of the most requested features from teams running Icinga in enterprise environments. Icinga Web SSO is a new module that adds OIDC provider support alongside your existing authentication backends, without replacing anything you already have in place.
Each provider you configure gets its own login button on the Icinga Web login page. Users click the button for their provider, authenticate against it, and are logged into Icinga Web with a username derived from the claim you choose, whether that is an email address, a nickname, or a full name.
Group membership works the same way. If your identity provider returns group information in its token claims, you can map those groups directly to Icinga Web groups. A search-and-replace regex on usernames and group names handles the cases where your provider and Icinga Web use different naming conventions. The module handles token refresh automatically, so sessions stay alive without requiring users to reauthenticate.
What ships in v1.0.0:
- Multiple OIDC providers can be configured simultaneously, each with its own login button on the Icinga Web login page.
- The username claim is configurable per provider, supporting nickname, email, full name, or any claim the provider exposes.
- Group membership can be mapped from provider claims to Icinga Web groups.
- Username and group name transformations are available via a search/replace regex, useful for adding provider-specific prefixes or normalizing names.
- Additional OAuth scopes can be requested per provider if needed.
- OIDC tokens are refreshed automatically from the session.
Icinga Director v1.11.9
This is a small patch release for installations preparing to move to the upcoming Icinga PHP Library 1.0.0 release. It keeps Director compatible with the updated dependency set while preserving support for current installations.
- Director remains compatible with the current dependency set and the upcoming Icinga PHP Library 1.0.0 release.
- Asynchronous operations continue to work during the transition to the updated dependency set.
If you are not preparing for the upcoming Icinga PHP Library 1.0.0 release yet, Icinga Director 1.11.8 continues to work. This release is for installations that want to be ready for that update.
Icinga vSphere® Integration v1.8.4
This maintenance release brings the vSphere module into line with the updated dependency set and resolves a rendering bug that could cause division-by-zero errors in disk usage views.
- A fatal incompatibility error on PHP 8.5 has been fixed.
- The daemon process remains compatible with the current and upcoming dependency sets.
- Disk usage views no longer fail when guest disks report zero capacity.
- Monitoring rule inheritance now works for virtual machine objects without a parent node.
Upgrading
Icinga Web SSO v1.0.0 is a fresh installation for everyone. Install the icinga-web-sso package, enable the module, and configure your OIDC providers through the module configuration.
Icinga Director v1.11.9 is a drop-in replacement for v1.11.8. No configuration changes required and after the update restart the daemon process.
Icinga vSphere® Integration v1.8.4 is a maintenance update for existing installations. No configuration changes required and after the update restart the daemon process.
