Security in Icinga Web: Features and Configuration Webinar

Most Icinga Web installations start with one admin account, local users and the default role. That works until the setup carries real operational weight and more than a handful of people log in. This webinar walks through the authentication and authorization features Icinga Web ships today, and shows the configuration behind each of them.

Icinga Web 2.14 added configurable password policies and a Content Security Policy you can inspect instead of guess at. Two modules extend the login itself: Icinga TOTP Web 1.0.0 for time-based one-time passwords, and Icinga Web SSO 1.0.0 for OpenID Connect. On the authorization side we go through roles, permissions and restrictions, the part that decides what a user sees once they are past the login form.

Recorded live on September 23, 2026 at 3 PM CEST.

In this session, we cover:

• Password policies in Icinga Web 2.14: the built-in Common policy with its 12-character minimum, mixed case, digit and special character, and how to register your own rules through the PasswordPolicyHook
• Two-factor authentication with Icinga TOTP Web 1.0.0: setting up the database resource, issuer name and clock drift, and walking a user through enrollment with QR code, raw secret and an SVG backup
• Single sign-on with Icinga Web SSO 1.0.0: configuring one or more OpenID Connect providers, choosing the claim a username is derived from, and mapping provider groups onto Icinga Web groups
• Roles, permissions and restrictions: granting access to modules and actions, and using filter-based restrictions so a team only sees the hosts and services that belong to it
• The new Content Security Policy settings page: reading the effective policy grouped by source, the security analysis that flags risky keywords and schemes, and when to take manual control

📌 Resources:

• The webinars overview page: https://icinga.com/webinars/
• Live Demo: https://demo.icinga.com/
• Learn more about Icinga: https://icinga.com/
• Get started with Icinga: https://icinga.com/get-started/

0:00 Welcome and why this webinar

3:20 Authentication vs. authorization

5:20 Where users are stored

7:57 Password policies with demo and custom hook)

14:52 Two-factor authentication with TOTP

21:23 Single sign-on with OpenID Connect

26:35 Permissions and restrictions

29:08 Demo: building and scoping roles

38:31 Auditing effective permissions

42:39 Content Security Policy

47:55 Q&A: auditing user and privilege changes

49:10 Q&A: audit with SSO group roles

50:14 Q&A: enforcing 2FA for users or groups

51:03 Q&A: Entra ID and OpenID Connect

53:18 Q&A: combining restriction filters

55:45 Q&A: CSP settings for the Maps module

57:41 Next webinar and goodbye