IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2026-08-26 21:37:31 -05:00
Code Issues Packages Projects Releases Wiki Activity

Add and document option for enabling email lookup (#913)

Browse Source 
* Docs: Document option for enabling email lookup

* Add the new config in the config files

* Apply suggestions from code review

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>

* Don't capitalize identity providers

* Apply suggestions from code review

Co-authored-by: Jo <joao.guerreiro@grafana.com>

* Apply suggestions from code review

Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>

---------

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
Co-authored-by: Jo <joao.guerreiro@grafana.com>
Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>
This commit is contained in:
Vardan Torosyan
2023-06-23 09:08:04 +02:00
committed by Horst Gutmann
co-authored by Ieva Jo Christopher Moyer
parent b8a336c9d7
commit 87b127e073
4 changed files with 55 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/sources/breaking-changes/breaking-changes-v10-0.md
+32
View File
@@ -158,6 +158,38 @@ We've built a [CLI tool](https://grafana.com/blog/2022/12/12/guide-to-using-the-
- [Blog post describing usage of the new CLI command](https://grafana.com/blog/2022/12/12/guide-to-using-the-new-grafana-cli-user-identity-conflict-tool-in-grafana-9.3/)
### Grafana OAuth integrations do not work anymore with email lookups
#### You are affected if:
- You have configured Grafana to use multiple identity providers, and you have users with the same email address in multiple identity providers.
- You have configured Grafana to use Generic OAuth with an identity provider that does not support a unique ID field.
#### Background
Grafana used to validate identity provider accounts based on the email claim. On many identity providers, the email field is not unique, and this could open a possible account vector to perform an account takeover and authentication bypass in certain scenarios.
This change also ensures that Grafana is protected against the [CVE-2023-3128](https://grafana.com/security/security-advisories/CVE-2023-3128) vulnerability.
#### Change in Grafana v10
Grafana will not allow the affected users to sign in.
#### Migration path
In order to address any errors, we have provided an escape hatch that allows you to activate email lookup. You can use the following configuration in your Grafana instance to return the previous behavior.
```
[auth]
oauth_allow_insecure_email_lookup = true
```
We strongly recommend not doing this in case you are using Azure AD as an identity provider with a multi-tenant app.
#### Learn more
- [CVE-2023-3128 Advisory](https://grafana.com/security/security-advisories/CVE-2023-3128)
- [Enable email lookup]({{< relref "../setup-grafana/configure-security/configure-authentication/" >}})
### The "Alias" field in the CloudWatch data source is removed
#### You are affected if: