Werk #22208: Support SAML on remote sites and allow per-site authentication configuration
| Component | Setup | ||
| Title | Support SAML on remote sites and allow per-site authentication configuration | ||
| Date | Aug 20, 2026 | ||
| Level | Major Change | ||
| Class | New Feature | ||
| Compatibility | Incompatible - Manual interaction might be required | ||
| Checkmk versions & editions |
|
You can now decide per site which connections may authenticate users there, and in the Pro editions and above, users can log in to a remote site via SAML.
What changed
Every site in Setup > Distributed monitoring now has two separate fields instead of the single User synchronization field:
Authentication connections decides who may log in on this site. Pick Disabled (Use the local users of the central site) to allow no LDAP or SAML login, Use the following to name specific connections, or Use all to enable every configured connection of the types you select, including connections you add later. The connections listed here are also the ones that create users on the site and set them up initially.
Attribute sync connections decides whose attributes (alias, email, roles and contact groups) the periodic synchronization keeps up to date on this site.
Multi-tenancy
In the Ultimate edition with multi-tenancy, a SAML connection is scoped to exactly one customer, chosen directly below the connection ID and defaulting to the provider. There is no Global scope for SAML connections. Users created when someone logs in via SAML belong to that customer, the same way LDAP connections already behaved.
What happens when you update (INCOMPATIBLE CHANGE)
The old value moves to Attribute sync connections. Authentication connections stays permissive, so every login that worked before the update still works afterwards, including the users those logins create on the site.
Remote sites are migrated to LDAP connections only, never SAML, even where the central site ends up with both. SAML could not authenticate on a remote site before this version, so enrolling every SAML connection automatically would widen the authentication surface of those sites. To let users log in to a remote site via SAML, add the connection to that site's Authentication connections after the update and activate the change.
The matching REST API change is described in werk #18500.