trustchain-oc1-orchestral/authentik
Archived
10
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

feat(docs/grafana): Add role mapping info (#756)

Browse source 
* feat(docs/grafana): Add role mapping info

* feat(docs/grafana): More info on role mappings
This commit is contained in:
tigattack 2021-04-19 18:07:09 +01:00 committed by GitHub
parent 10b45a8dea
commit ef080900a4
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 19 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
website/docs/integrations/services/grafana/index.mdx
View file

@ -52,8 +52,10 @@ environment:
GF_AUTH_GENERIC_OAUTH_TOKEN_URL: "https://authentik.company/application/o/token/" GF_AUTH_GENERIC_OAUTH_TOKEN_URL: "https://authentik.company/application/o/token/"
GF_AUTH_GENERIC_OAUTH_API_URL: "https://authentik.company/application/o/userinfo/" GF_AUTH_GENERIC_OAUTH_API_URL: "https://authentik.company/application/o/userinfo/"
GF_AUTH_SIGNOUT_REDIRECT_URL: "https://authentik.company/application/o/<Slug of the application from above>/end-session/" GF_AUTH_SIGNOUT_REDIRECT_URL: "https://authentik.company/application/o/<Slug of the application from above>/end-session/"
# Optionally enable auto-login # Optionally enable auto-login (bypasses Grafana login screen)
GF_AUTH_OAUTH_AUTO_LOGIN: "true" GF_AUTH_OAUTH_AUTO_LOGIN: "true"
# Optionally map user groups to Grafana roles
GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH=contains(groups[*], 'Grafana Admins') && 'Admin' || contains(groups[*], 'Grafana Editors') && 'Editor' || 'Viewer'
``` ```
</TabItem> </TabItem>
<TabItem value="standalone"> <TabItem value="standalone">
@ -74,6 +76,22 @@ scopes = openid email profile
auth_url = https://authentik.company/application/o/authorize/ auth_url = https://authentik.company/application/o/authorize/
token_url = https://authentik.company/application/o/token/ token_url = https://authentik.company/application/o/token/
api_url = https://authentik.company/application/o/userinfo/ api_url = https://authentik.company/application/o/userinfo/
# Optionally map user groups to Grafana roles
role_attribute_path = contains(groups[*], 'Grafana Admins') && 'Admin' || contains(groups[*], 'Grafana Editors') && 'Editor' || 'Viewer'
``` ```
</TabItem> </TabItem>
</Tabs> </Tabs>
### Role Mappings
In the configuration above you can see an example of a role mapping. Upon login, this configuration looks at the groups of which the current user is a member. If any of the specified group names are found, the user will be granted the resulting role in Grafana.
In the example shown above, one of the specified group names is "Grafana Admins". If the user is a member of this group, they will be granted the "Admin" role in Grafana.
If the user is not a member of the "Grafana Admins" group, it moves on to see if the user is a member of the "Grafana Editors" group. If they are, they are granted the "Editor" role. Finally, if the user is not found to be a member of either of these groups, it fails back to granting the "Viewer" role.
```text
contains(groups[*], 'Grafana Admins') && 'Admin' || contains(groups[*], 'Grafana Editors') && 'Editor' || 'Viewer'
^ attribute to search ^ group to search for ^ role to grant ^ or grant "Viewer" role.
```
For more information on group/role mappings, see [Grafana's docs](https://grafana.com/docs/grafana/latest/auth/generic-oauth/#role-mapping).