218 lines
8.5 KiB
Plaintext
218 lines
8.5 KiB
Plaintext
---
|
|
title: Grafana
|
|
---
|
|
|
|
<span class="badge badge--primary">Support level: authentik</span>
|
|
|
|
## What is Grafana
|
|
|
|
> Grafana is a multi-platform open source analytics and interactive visualization web application. It provides charts, graphs, and alerts for the web when connected to supported data sources, Grafana Enterprise version with additional capabilities is also available. It is expandable through a plug-in system.
|
|
>
|
|
> -- https://en.wikipedia.org/wiki/Grafana
|
|
|
|
## Preparation
|
|
|
|
The following placeholders will be used:
|
|
|
|
- `grafana.company` is the FQDN of the Grafana install.
|
|
- `authentik.company` is the FQDN of the authentik install.
|
|
|
|
Create an application in authentik. Create an OAuth2/OpenID provider with the following parameters:
|
|
|
|
- Client Type: `Confidential`
|
|
- Scopes: OpenID, Email and Profile
|
|
- Signing Key: Select any available key
|
|
- Redirect URIs: `https://grafana.company/login/generic_oauth`
|
|
|
|
Additionally, because Grafana has its own concept of groups, we need to create a custom Scope Mapping to ensure Grafana can read the user's groups assigned within authentik. It should contain the following expression:
|
|
|
|
```json
|
|
return {
|
|
"info": { "groups": [group.name for group in request.user.ak_groups.all()] },
|
|
}
|
|
```
|
|
|
|
This ensures that groups are available under `info.groups[]`, which can be used later in [Role Mapping](#role-mappings).
|
|
|
|
Note the Client ID and Client Secret values. Create an application, using the provider you've created above. Note the slug of the application you've created.
|
|
|
|
## Terraform provider
|
|
|
|
```hcl
|
|
|
|
data "authentik_flow" "default-provider-authorization-implicit-consent" {
|
|
slug = "default-provider-authorization-implicit-consent"
|
|
}
|
|
|
|
data "authentik_scope_mapping" "scope-email" {
|
|
name = "authentik default OAuth Mapping: OpenID 'email'"
|
|
}
|
|
|
|
data "authentik_scope_mapping" "scope-profile" {
|
|
name = "authentik default OAuth Mapping: OpenID 'profile'"
|
|
}
|
|
|
|
data "authentik_scope_mapping" "scope-openid" {
|
|
name = "authentik default OAuth Mapping: OpenID 'openid'"
|
|
}
|
|
|
|
resource "authentik_scope_mapping" "scope-grafana-roles" {
|
|
name = "Grafana Groups"
|
|
scope_name = "grafana-groups"
|
|
expression = <<EOF
|
|
return {
|
|
"info": { "groups": [group.name for group in request.user.ak_groups.all()] },
|
|
}
|
|
EOF
|
|
}
|
|
|
|
resource "authentik_provider_oauth2" "grafana" {
|
|
name = "Grafana"
|
|
# Required. You can use the output of:
|
|
# $ openssl rand -hex 16
|
|
client_id = "my_client_id"
|
|
|
|
# Optional: will be generated if not provided
|
|
# client_secret = "my_client_secret"
|
|
|
|
authorization_flow = data.authentik_flow.default-provider-authorization-implicit-consent.id
|
|
|
|
redirect_uris = ["https://grafana.company/login/generic_oauth"]
|
|
|
|
property_mappings = [
|
|
data.authentik_scope_mapping.scope-email.id,
|
|
data.authentik_scope_mapping.scope-profile.id,
|
|
data.authentik_scope_mapping.scope-openid.id,
|
|
authentik_scope_mapping.scope-grafana-roles.id,
|
|
]
|
|
}
|
|
|
|
resource "authentik_application" "grafana" {
|
|
name = "Grafana"
|
|
slug = "grafana"
|
|
protocol_provider = authentik_provider_oauth2.grafana.id
|
|
}
|
|
|
|
resource "authentik_group" "grafana_admins" {
|
|
name = "Grafana Admins"
|
|
}
|
|
|
|
resource "authentik_group" "grafana_editors" {
|
|
name = "Grafana Editors"
|
|
}
|
|
|
|
resource "authentik_group" "grafana_viewers" {
|
|
name = "Grafana Viewers"
|
|
}
|
|
|
|
```
|
|
|
|
## Grafana configuration
|
|
|
|
import Tabs from "@theme/Tabs";
|
|
import TabItem from "@theme/TabItem";
|
|
|
|
<Tabs
|
|
defaultValue="docker"
|
|
values={[
|
|
{label: 'Docker', value: 'docker'},
|
|
{label: 'Standalone', value: 'standalone'},
|
|
{label: 'Helm', value: 'helm'},
|
|
]}>
|
|
<TabItem value="docker">
|
|
If your Grafana instance is running in Docker, set the following environment variables:
|
|
|
|
```yaml
|
|
environment:
|
|
GF_AUTH_GENERIC_OAUTH_ENABLED: "true"
|
|
GF_AUTH_GENERIC_OAUTH_NAME: "authentik"
|
|
GF_AUTH_GENERIC_OAUTH_CLIENT_ID: "<Client ID from above>"
|
|
GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: "<Client Secret from above>"
|
|
GF_AUTH_GENERIC_OAUTH_SCOPES: "openid profile email"
|
|
GF_AUTH_GENERIC_OAUTH_AUTH_URL: "https://authentik.company/application/o/authorize/"
|
|
GF_AUTH_GENERIC_OAUTH_TOKEN_URL: "https://authentik.company/application/o/token/"
|
|
GF_AUTH_GENERIC_OAUTH_API_URL: "https://authentik.company/application/o/userinfo/"
|
|
GF_AUTH_SIGNOUT_REDIRECT_URL: "https://authentik.company/application/o/<Slug of the application from above>/end-session/"
|
|
# Optionally enable auto-login (bypasses Grafana login screen)
|
|
GF_AUTH_OAUTH_AUTO_LOGIN: "true"
|
|
# Optionally map user groups to Grafana roles
|
|
GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH: "contains(info.groups[*], 'Grafana Admins') && 'Admin' || contains(info.groups[*], 'Grafana Editors') && 'Editor' || 'Viewer'"
|
|
```
|
|
|
|
</TabItem>
|
|
<TabItem value="standalone">
|
|
If you are using a config-file instead, you have to set these options:
|
|
|
|
```ini
|
|
[auth]
|
|
signout_redirect_url = https://authentik.company/application/o/<Slug of the application from above>/end-session/
|
|
# Optionally enable auto-login
|
|
oauth_auto_login = true
|
|
|
|
[auth.generic_oauth]
|
|
name = authentik
|
|
enabled = true
|
|
client_id = <Client ID from above>
|
|
client_secret = <Client Secret from above>
|
|
scopes = openid email profile
|
|
auth_url = https://authentik.company/application/o/authorize/
|
|
token_url = https://authentik.company/application/o/token/
|
|
api_url = https://authentik.company/application/o/userinfo/
|
|
# Optionally map user groups to Grafana roles
|
|
role_attribute_path = contains(info.groups[*], 'Grafana Admins') && 'Admin' || contains(info.groups[*], 'Grafana Editors') && 'Editor' || 'Viewer'
|
|
```
|
|
|
|
</TabItem>
|
|
<TabItem value="helm">
|
|
If you are using a Helm `values.yaml` file instead, you have to set these options:
|
|
|
|
```yaml
|
|
grafana.ini:
|
|
auth:
|
|
signout_redirect_url: "https://authentik.company/application/o/<Slug of the application from above>/end-session/"
|
|
oauth_auto_login: true
|
|
auth.generic_oauth:
|
|
name: authentik
|
|
enabled: true
|
|
client_id: "<Client ID from above>"
|
|
client_secret: "<Client Secret from above>"
|
|
scopes: "openid profile email"
|
|
auth_url: "https://authentik.company/application/o/authorize/"
|
|
token_url: "https://authentik.company/application/o/token/"
|
|
api_url: "https://authentik.company/application/o/userinfo/"
|
|
# Optionally map user groups to Grafana roles
|
|
role_attribute_path: contains(info.groups[*], 'Grafana Admins') && 'Admin' || contains(info.groups[*], 'Grafana Editors') && 'Editor' || 'Viewer'
|
|
```
|
|
|
|
:::note
|
|
For security reasons you shouldn't inline the client_secret in the values, but use a secret instead. For more information, see https://github.com/grafana/helm-charts/blob/main/charts/grafana/README.md#how-to-securely-reference-secrets-in-grafanaini
|
|
:::
|
|
|
|
</TabItem>
|
|
</Tabs>
|
|
|
|
### Role Mappings
|
|
|
|
In the configuration above you can see an example of a role mapping. Upon login, this configuration looks at the groups of which the current user is a member. If any of the specified group names are found, the user will be granted the resulting role in Grafana.
|
|
|
|
In the example shown above, one of the specified group names is "Grafana Admins". If the user is a member of this group, they will be granted the "Admin" role in Grafana.
|
|
If the user is not a member of the "Grafana Admins" group, it moves on to see if the user is a member of the "Grafana Editors" group. If they are, they are granted the "Editor" role. Finally, if the user is not found to be a member of either of these groups, it fails back to granting the "Viewer" role.
|
|
|
|
```text
|
|
contains(info.groups[*], 'Grafana Admins') && 'Admin' || contains(info.groups[*], 'Grafana Editors') && 'Editor' || 'Viewer'
|
|
^ attribute ^ group to search for^ role to grant ^ or grant "Viewer" role.
|
|
```
|
|
|
|
For more information on group/role mappings, see [Grafana's docs](https://grafana.com/docs/grafana/latest/auth/generic-oauth/#role-mapping).
|
|
|
|
### Grafana Configuration Considerations
|
|
|
|
Make sure in your configuration that `root_url` is set correctly, otherwise your redirect url might get processed incorrectly. For example, if your grafana instance is running on the default configuration and is accessible behind a reverse proxy at `https://grafana.company`, your redirect url will end up looking like this, `https://grafana.company/`.
|
|
If you get `user does not belong to org` error when trying to log into grafana for the first time via OAuth, check if you have an organization with the ID of `1`, if not, then you have to add the following to your grafana config:
|
|
|
|
```ini
|
|
[users]
|
|
auto_assign_org = true
|
|
auto_assign_org_id = <id-of-your-default-organization>
|
|
```
|