mirror of
https://github.com/grafana/grafana.git
synced 2026-07-29 15:59:50 -05:00
Change metadata of doc topics (#27943)
* Changes. to metadata in Manage users * changes to install section * Added titile * More changes. * Updated administration folder metadata, moved 2 files from installation folder. * Added links to Administration landing page, other metadata changes worked out. * Updated alerting section metadata. * Updated metadata of Auth section. Broke index and created separate Grafana Authentication section. * Added correct weight. * Updated metadata for the Best practices section. * Updated metadata in templates, broke Overview topic. * Updated subment Variable types metadata * Fixed yaml file and H1 description of Variables syntax topic. * Couple more metadata changes. * Added aliases files, as suggested by Diana.
This commit is contained in:
achatterjee-grafana
+3
-116
@@ -6,7 +6,7 @@ type = "docs"
|
||||
name = "Authentication"
|
||||
identifier = "authentication"
|
||||
parent = "admin"
|
||||
weight = 3
|
||||
weight = 30
|
||||
+++
|
||||
|
||||
# User Authentication Overview
|
||||
@@ -15,6 +15,8 @@ Grafana provides many ways to authenticate users. Some authentication integratio
|
||||
|
||||
Here is a table showing all supported authentication providers and the features available for them. [Team sync]({{< relref "../enterprise/team-sync.md" >}}) and [active sync]({{< relref "../enterprise/enhanced_ldap.md#active-ldap-synchronization" >}}) are only available in Grafana Enterprise.
|
||||
|
||||
See also, [Grafana Authentication]({{< relref "grafana.md" >}}).
|
||||
|
||||
Provider | Support | Role mapping | Team sync<br> *(Enterprise only)* | Active sync<br> *(Enterprise only)*
|
||||
-------- | :-----: | :----------: | :-------: | :---------:
|
||||
[Auth Proxy]({{< relref "auth-proxy.md" >}}) | v2.1+ | - | v6.3+ | -
|
||||
@@ -26,118 +28,3 @@ Provider | Support | Role mapping | Team sync<br> *(Enterprise only)* | Active s
|
||||
[LDAP]({{< relref "ldap.md" >}}) | v2.1+ | v2.1+ | v5.3+ | v6.3+
|
||||
[Okta OAuth]({{< relref "okta.md" >}}) | v7.0+ | v7.0+ | v7.0+ | -
|
||||
[SAML]({{< relref "../enterprise/saml.md" >}}) (Enterprise only) | v6.3+ | v7.0+ | v7.0+ | -
|
||||
|
||||
## Grafana Auth
|
||||
|
||||
Grafana of course has a built in user authentication system with password authentication enabled by default. You can
|
||||
disable authentication by enabling anonymous access. You can also hide login form and only allow login through an auth
|
||||
provider (listed above). There is also options for allowing self sign up.
|
||||
|
||||
### Login and short-lived tokens
|
||||
|
||||
> The following applies when using Grafana's built in user authentication, LDAP (without Auth proxy) or OAuth integration.
|
||||
|
||||
Grafana are using short-lived tokens as a mechanism for verifying authenticated users.
|
||||
These short-lived tokens are rotated each `token_rotation_interval_minutes` for an active authenticated user.
|
||||
|
||||
An active authenticated user that gets it token rotated will extend the `login_maximum_inactive_lifetime_days` time from "now" that Grafana will remember the user.
|
||||
This means that a user can close its browser and come back before `now + login_maximum_inactive_lifetime_days` and still being authenticated.
|
||||
This is true as long as the time since user login is less than `login_maximum_lifetime_days`.
|
||||
|
||||
#### Remote logout
|
||||
|
||||
You can logout from other devices by removing login sessions from the bottom of your profile page. If you are
|
||||
a Grafana admin user you can also do the same for any user from the Server Admin / Edit User view.
|
||||
|
||||
## Settings
|
||||
|
||||
Example:
|
||||
|
||||
```bash
|
||||
[auth]
|
||||
|
||||
# Login cookie name
|
||||
login_cookie_name = grafana_session
|
||||
|
||||
# The lifetime (days) an authenticated user can be inactive before being required to login at next visit. Default is 7 days.
|
||||
login_maximum_inactive_lifetime_days = 7
|
||||
|
||||
# The maximum lifetime (days) an authenticated user can be logged in since login time before being required to login. Default is 30 days.
|
||||
login_maximum_lifetime_days = 30
|
||||
|
||||
# How often should auth tokens be rotated for authenticated users when being active. The default is each 10 minutes.
|
||||
token_rotation_interval_minutes = 10
|
||||
|
||||
# The maximum lifetime (seconds) an api key can be used. If it is set all the api keys should have limited lifetime that is lower than this value.
|
||||
api_key_max_seconds_to_live = -1
|
||||
```
|
||||
|
||||
### Anonymous authentication
|
||||
|
||||
You can make Grafana accessible without any login required by enabling anonymous access in the configuration file.
|
||||
|
||||
Example:
|
||||
|
||||
```bash
|
||||
[auth.anonymous]
|
||||
enabled = true
|
||||
|
||||
# Organization name that should be used for unauthenticated users
|
||||
org_name = Main Org.
|
||||
|
||||
# Role for unauthenticated users, other valid values are `Editor` and `Admin`
|
||||
org_role = Viewer
|
||||
```
|
||||
|
||||
If you change your organization name in the Grafana UI this setting needs to be updated to match the new name.
|
||||
|
||||
### Basic authentication
|
||||
|
||||
Basic auth is enabled by default and works with the built in Grafana user password authentication system and LDAP
|
||||
authentication integration.
|
||||
|
||||
To disable basic auth:
|
||||
|
||||
```bash
|
||||
[auth.basic]
|
||||
enabled = false
|
||||
```
|
||||
|
||||
### Disable login form
|
||||
|
||||
You can hide the Grafana login form using the below configuration settings.
|
||||
|
||||
```bash
|
||||
[auth]
|
||||
disable_login_form = true
|
||||
```
|
||||
|
||||
### Automatic OAuth login
|
||||
|
||||
Set to true to attempt login with OAuth automatically, skipping the login screen.
|
||||
This setting is ignored if multiple OAuth providers are configured.
|
||||
Defaults to `false`.
|
||||
|
||||
```bash
|
||||
[auth]
|
||||
oauth_auto_login = true
|
||||
```
|
||||
|
||||
### Hide sign-out menu
|
||||
|
||||
Set the option detailed below to true to hide sign-out menu link. Useful if you use an auth proxy.
|
||||
|
||||
```bash
|
||||
[auth]
|
||||
disable_signout_menu = true
|
||||
```
|
||||
|
||||
### URL redirect after signing out
|
||||
|
||||
URL to redirect the user to after signing out from Grafana. This can for example be used to enable signout from oauth provider.
|
||||
|
||||
```bash
|
||||
[auth]
|
||||
signout_redirect_url =
|
||||
```
|
||||
|
||||
|
||||
@@ -8,7 +8,7 @@ aliases = ["/docs/grafana/latest/tutorials/authproxy/"]
|
||||
name = "Auth Proxy"
|
||||
identifier = "auth-proxy"
|
||||
parent = "authentication"
|
||||
weight = 2
|
||||
weight = 200
|
||||
+++
|
||||
|
||||
# Auth Proxy Authentication
|
||||
|
||||
@@ -7,7 +7,7 @@ type = "docs"
|
||||
name = "Azure AD"
|
||||
identifier = "azuread_oauth2"
|
||||
parent = "authentication"
|
||||
weight = 3
|
||||
weight = 700
|
||||
+++
|
||||
|
||||
# Azure AD OAuth2 authentication
|
||||
|
||||
@@ -7,7 +7,7 @@ type = "docs"
|
||||
name = "Enhanced LDAP"
|
||||
identifier = "enhanced-ldap"
|
||||
parent = "authentication"
|
||||
weight = 3
|
||||
weight = 400
|
||||
+++
|
||||
|
||||
# Enhanced LDAP integration
|
||||
|
||||
@@ -7,18 +7,19 @@ type = "docs"
|
||||
name = "Generic OAuth"
|
||||
identifier = "generic_oauth"
|
||||
parent = "authentication"
|
||||
weight = 3
|
||||
weight = 500
|
||||
+++
|
||||
|
||||
# Generic OAuth Authentication
|
||||
|
||||
You can configure many different OAuth2 authentication services with Grafana using the generic OAuth2 feature. Examples:
|
||||
- [Auth0](#set-up-oauth2-with-auth0)
|
||||
- [Azure AD]({{< relref "azuread.md" >}})
|
||||
- [BitBucket](#set-up-oauth2-with-bitbucket)
|
||||
- [Centrify](#set-up-oauth2-with-centrify)
|
||||
- [Okta]({{< relref "okta.md" >}})
|
||||
- [OneLogin](#set-up-oauth2-with-onelogin)
|
||||
- [Generic OAuth Authentication](#generic-oauth-authentication)
|
||||
- [Set up OAuth2 with Auth0](#set-up-oauth2-with-auth0)
|
||||
- [Set up OAuth2 with Bitbucket](#set-up-oauth2-with-bitbucket)
|
||||
- [Set up OAuth2 with Centrify](#set-up-oauth2-with-centrify)
|
||||
- [Set up OAuth2 with OneLogin](#set-up-oauth2-with-onelogin)
|
||||
- [JMESPath examples](#jmespath-examples)
|
||||
- [Role mapping](#role-mapping)
|
||||
|
||||
This callback URL must match the full HTTP address that you use in your browser to access Grafana, but with the prefix path of `/login/generic_oauth`.
|
||||
|
||||
|
||||
@@ -7,7 +7,7 @@ type = "docs"
|
||||
name = "GitHub"
|
||||
identifier = "github_oauth2"
|
||||
parent = "authentication"
|
||||
weight = 4
|
||||
weight = 800
|
||||
+++
|
||||
|
||||
# GitHub OAuth2 Authentication
|
||||
|
||||
@@ -7,7 +7,7 @@ type = "docs"
|
||||
name = "GitLab"
|
||||
identifier = "gitlab_oauth"
|
||||
parent = "authentication"
|
||||
weight = 5
|
||||
weight = 900
|
||||
+++
|
||||
|
||||
# GitLab OAuth2 Authentication
|
||||
|
||||
@@ -7,7 +7,7 @@ type = "docs"
|
||||
name = "Google"
|
||||
identifier = "google_oauth2"
|
||||
parent = "authentication"
|
||||
weight = 3
|
||||
weight = 600
|
||||
+++
|
||||
|
||||
# Google OAuth2 Authentication
|
||||
|
||||
@@ -0,0 +1,125 @@
|
||||
+++
|
||||
title = "Grafana Authentication"
|
||||
description = "Grafana OAuthentication Guide "
|
||||
keywords = ["grafana", "configuration", "documentation", "oauth"]
|
||||
type = "docs"
|
||||
[menu.docs]
|
||||
name = "GitLab"
|
||||
identifier = "grafana-oauth"
|
||||
parent = "authentication"
|
||||
weight = 100
|
||||
+++
|
||||
|
||||
## Grafana Auth
|
||||
|
||||
Grafana of course has a built in user authentication system with password authentication enabled by default. You can
|
||||
disable authentication by enabling anonymous access. You can also hide login form and only allow login through an auth
|
||||
provider (listed above). There is also options for allowing self sign up.
|
||||
|
||||
### Login and short-lived tokens
|
||||
|
||||
> The following applies when using Grafana's built in user authentication, LDAP (without Auth proxy) or OAuth integration.
|
||||
|
||||
Grafana are using short-lived tokens as a mechanism for verifying authenticated users.
|
||||
These short-lived tokens are rotated each `token_rotation_interval_minutes` for an active authenticated user.
|
||||
|
||||
An active authenticated user that gets it token rotated will extend the `login_maximum_inactive_lifetime_days` time from "now" that Grafana will remember the user.
|
||||
This means that a user can close its browser and come back before `now + login_maximum_inactive_lifetime_days` and still being authenticated.
|
||||
This is true as long as the time since user login is less than `login_maximum_lifetime_days`.
|
||||
|
||||
#### Remote logout
|
||||
|
||||
You can logout from other devices by removing login sessions from the bottom of your profile page. If you are
|
||||
a Grafana admin user you can also do the same for any user from the Server Admin / Edit User view.
|
||||
|
||||
## Settings
|
||||
|
||||
Example:
|
||||
|
||||
```bash
|
||||
[auth]
|
||||
|
||||
# Login cookie name
|
||||
login_cookie_name = grafana_session
|
||||
|
||||
# The lifetime (days) an authenticated user can be inactive before being required to login at next visit. Default is 7 days.
|
||||
login_maximum_inactive_lifetime_days = 7
|
||||
|
||||
# The maximum lifetime (days) an authenticated user can be logged in since login time before being required to login. Default is 30 days.
|
||||
login_maximum_lifetime_days = 30
|
||||
|
||||
# How often should auth tokens be rotated for authenticated users when being active. The default is each 10 minutes.
|
||||
token_rotation_interval_minutes = 10
|
||||
|
||||
# The maximum lifetime (seconds) an api key can be used. If it is set all the api keys should have limited lifetime that is lower than this value.
|
||||
api_key_max_seconds_to_live = -1
|
||||
```
|
||||
|
||||
### Anonymous authentication
|
||||
|
||||
You can make Grafana accessible without any login required by enabling anonymous access in the configuration file.
|
||||
|
||||
Example:
|
||||
|
||||
```bash
|
||||
[auth.anonymous]
|
||||
enabled = true
|
||||
|
||||
# Organization name that should be used for unauthenticated users
|
||||
org_name = Main Org.
|
||||
|
||||
# Role for unauthenticated users, other valid values are `Editor` and `Admin`
|
||||
org_role = Viewer
|
||||
```
|
||||
|
||||
If you change your organization name in the Grafana UI this setting needs to be updated to match the new name.
|
||||
|
||||
### Basic authentication
|
||||
|
||||
Basic auth is enabled by default and works with the built in Grafana user password authentication system and LDAP
|
||||
authentication integration.
|
||||
|
||||
To disable basic auth:
|
||||
|
||||
```bash
|
||||
[auth.basic]
|
||||
enabled = false
|
||||
```
|
||||
|
||||
### Disable login form
|
||||
|
||||
You can hide the Grafana login form using the below configuration settings.
|
||||
|
||||
```bash
|
||||
[auth]
|
||||
disable_login_form = true
|
||||
```
|
||||
|
||||
### Automatic OAuth login
|
||||
|
||||
Set to true to attempt login with OAuth automatically, skipping the login screen.
|
||||
This setting is ignored if multiple OAuth providers are configured.
|
||||
Defaults to `false`.
|
||||
|
||||
```bash
|
||||
[auth]
|
||||
oauth_auto_login = true
|
||||
```
|
||||
|
||||
### Hide sign-out menu
|
||||
|
||||
Set the option detailed below to true to hide sign-out menu link. Useful if you use an auth proxy.
|
||||
|
||||
```bash
|
||||
[auth]
|
||||
disable_signout_menu = true
|
||||
```
|
||||
|
||||
### URL redirect after signing out
|
||||
|
||||
URL to redirect the user to after signing out from Grafana. This can for example be used to enable signout from oauth provider.
|
||||
|
||||
```bash
|
||||
[auth]
|
||||
signout_redirect_url =
|
||||
```
|
||||
@@ -8,7 +8,7 @@ aliases = ["/docs/grafana/latest/installation/ldap/"]
|
||||
name = "LDAP"
|
||||
identifier = "ldap"
|
||||
parent = "authentication"
|
||||
weight = 2
|
||||
weight = 300
|
||||
+++
|
||||
|
||||
# LDAP Authentication
|
||||
|
||||
@@ -7,7 +7,7 @@ type = "docs"
|
||||
name = "Okta"
|
||||
identifier = "okta_oauth2"
|
||||
parent = "authentication"
|
||||
weight = 3
|
||||
weight = 1000
|
||||
+++
|
||||
|
||||
# Okta OAuth2 authentication
|
||||
|
||||
@@ -7,7 +7,7 @@ type = "docs"
|
||||
[menu.docs]
|
||||
name = "SAML"
|
||||
parent = "authentication"
|
||||
weight = 5
|
||||
weight = 1100
|
||||
+++
|
||||
|
||||
# SAML authentication
|
||||
|
||||
@@ -7,7 +7,7 @@ type = "docs"
|
||||
[menu.docs]
|
||||
name = "Team Sync"
|
||||
parent = "authentication"
|
||||
weight = 5
|
||||
weight = 1200
|
||||
+++
|
||||
|
||||
# Team sync
|
||||
|
||||
Reference in New Issue
Block a user