Hello! After update to 2.4 SAML auth with mellon seems to not work anymore.
Tried to regenerate key and cert with mellon, but no result, the same config and key/certs works fine in 2.3p33. Have such message in Apache logs
*** stack smashing detected ***: terminated
[Wed Jun 11 10:32:25.651964 2025] [core:notice] [pid 57526:tid 57526] AH00052: child pid 65455 exit signal Abort (6)
If I change auth.conf to default one, without SAML it work OK, I can login via password.
#Set this to the Name of your Checkmk site, e.g.
# Define SITE mysite
Define SITE monitoring
# ServerName from listen-ports.conf needs to be overwritten here
# and being set to the URL of the real server.
# auth_mellon uses this to generate the needed URLs in the metadata.
ServerName https://monitoring
# Load the module.
<IfModule !mod_auth_mellon.c>
LoadModule auth_mellon_module /usr/lib/apache2/modules/mod_auth_mellon.so
</IfModule>
# Only enable this for debugging purposes
# MellonDiagnosticsFile /opt/omd/sites/${SITE}/tmp/mellon_diagnostics.log
# MellonDiagnosticsEnable On
<Location /${SITE}>
# Use SAML auth only in case there is no Checkmk authentication
# cookie provided by the user and whitelist also some other required URLs.
<If "! %{HTTP_COOKIE} =~ /^auth_${SITE}/ && \
! %{REQUEST_URI} = '/${SITE}/check_mk/register_agent.py' && \
! %{REQUEST_URI} = '/${SITE}/check_mk/restapi.py' && \
! %{REQUEST_URI} = '/${SITE}/check_mk/run_cron.py' && \
! %{REQUEST_URI} = '/${SITE}/check_mk/automation.py' && \
! %{REQUEST_URI} -strmatch '/${SITE}/check_mk/api/*' && \
! %{REQUEST_URI} = '/${SITE}/check_mk/deploy_agent.py' && \
! %{REQUEST_URI} = '/${SITE}check_mk/ajax_graph_images.py' && \
! %{QUERY_STRING} =~ /(_secret=|auth_|register_agent)/ && \
! %{REQUEST_URI} =~ m#^/${SITE}/(omd/|check_mk/((images|themes)/.*\.(png|svg)|login\.py|.*\.(css|js)))# ">
RequestHeader unset X-Remote-User
MellonIdPMetadataFile /opt/omd/sites/${SITE}/etc/apache/mellon/idp-metadata.xml
# Azure-AD-specific: Not needed because in metadata:
#MellonIdPPublicKeyFile /opt/omd/sites/${SITE}/etc/apache/mellon/idp-public-key.pem
MellonSPCertFile /opt/omd/sites/${SITE}/etc/apache/mellon/mellon.cert
MellonSPPrivateKeyFile /opt/omd/sites/${SITE}/etc/apache/mellon/mellon.key
MellonEndpointPath "/${SITE}/mellon"
MellonDefaultLoginPath "/${SITE}/check_mk/"
Order allow,deny
Allow from all
MellonSecureCookie On
MellonCookieSameSite None
AuthType Mellon
MellonEnable auth
require valid-user
# Azure-AD-specific:
# Get Username
# If your assertion offers the username for Checkmk in an attribute you can set it directly as the remote user (REMOTE_USER):
MellonUser "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"
RequestHeader set X-Remote-User "%{MELLON_http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name}e" env=MELLON_http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
# When SAML auth fails, show the login page to the user. This should only happen, if e.g. the mellon cookie is lost/rejected or if the IDP is misconfigured.
# A failed login at the IDP will not return you here at all.
ErrorDocument 401 '<html> \
<head> \
<meta http-equiv="refresh" content="1; URL=/${SITE}/check_mk/login.py"> \
</head> \
<body> \
SAML authentication failed, redirecting to login page. \
<a href="/${SITE}/check_mk/login.py">Click here</a>. \
</body> \
</html>'
</If>
# Azure-AD-specific:
# This header is also needed after authentication (outside of the If clause)
RequestHeader set X-Remote-User "%{MELLON_http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name}e" env=MELLON_http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
</Location>
Up to Checkmk version 2.2.0, as an alternative, SAML was also supported by the Apache mod_auth_mellon module, which was supplied as part of the Checkmk software. From version 2.3.0, mod_auth_mellon is no longer included in the Checkmk software. If you want to use SAML as a Checkmk Raw user, you must therefore install mod_auth_mellon yourself. The configuration based on this is described in chapter on Checkmk Raw. However, it is no longer supported by us.
Not to discourage usage of SAML, but in the past i switched from SAML to OpenID-Connect.
Been using it after there were some issues with SAML/mod_auth_mellon, and i found OIDC easyer to implement compared to SAML.
…And it gives the same functionality on RAW.
Still using it at current on both 2.3.0p35 CRE, as well as a 2.4.0p4 testbox.
So if you have the possibility, investigate OIDC: mod_auth_openidc
The howto ( and related stuff is posted in: This forumpost )
We also encountered the same error above with mellon after updating to 2.4 RAW. I tested auth with openidc per your suggestion and our SSO is now working in 2.4.0p9 RAW.
Checkmk Raw user, you must therefore install