mirror of
https://github.com/grafana/grafana.git
synced 2025-02-25 18:55:37 -06:00
Docs/restructures setup (#57125)
* builds out configure grafana directory to align with hugo * restructures configure authentication, corrects relrefs * correct alias * corrects final relrefs
This commit is contained in:
Christopher Moyer
GitHub
parent
6ad405e256
commit
d09d39ddd4
@ -42,13 +42,13 @@ Supported auth providers:
|
||||
- [Azure AD OAuth]({{< relref "../setup-grafana/configure-security/configure-authentication/azuread/#team-sync-enterprise-only" >}})
|
||||
- [GitHub OAuth]({{< relref "../setup-grafana/configure-security/configure-authentication/github/#team-sync-enterprise-only" >}})
|
||||
- [GitLab OAuth]({{< relref "../setup-grafana/configure-security/configure-authentication/gitlab/#team-sync-enterprise-only" >}})
|
||||
- [LDAP]({{< relref "../setup-grafana/configure-security/configure-authentication/enhanced_ldap/#ldap-group-synchronization-for-teams" >}})
|
||||
- [LDAP]({{< relref "../setup-grafana/configure-security/configure-authentication/enhanced-ldap/#ldap-group-synchronization-for-teams" >}})
|
||||
- [Okta]({{< relref "../setup-grafana/configure-security/configure-authentication/okta/#team-sync-enterprise-only" >}})
|
||||
- [SAML]({{< relref "../setup-grafana/configure-security/configure-authentication/saml/#configure-team-sync" >}})
|
||||
|
||||
### Enhanced LDAP integration
|
||||
|
||||
With [enhanced LDAP integration]({{< relref "../setup-grafana/configure-security/configure-authentication/enhanced_ldap/" >}}), you can set up active LDAP synchronization.
|
||||
With [enhanced LDAP integration]({{< relref "../setup-grafana/configure-security/configure-authentication/enhanced-ldap/" >}}), you can set up active LDAP synchronization.
|
||||
|
||||
### SAML authentication
|
||||
|
||||
|
||||
@ -33,13 +33,13 @@ Supported auth providers:
|
||||
- [Azure AD OAuth]({{< relref "../setup-grafana/configure-security/configure-authentication/azuread/#team-sync-enterprise-only" >}})
|
||||
- [GitHub OAuth]({{< relref "../setup-grafana/configure-security/configure-authentication/github/#team-sync-enterprise-only" >}})
|
||||
- [GitLab OAuth]({{< relref "../setup-grafana/configure-security/configure-authentication/gitlab/#team-sync-enterprise-only" >}})
|
||||
- [LDAP]({{< relref "../setup-grafana/configure-security/configure-authentication/enhanced_ldap/#ldap-group-synchronization-for-teams" >}})
|
||||
- [LDAP]({{< relref "../setup-grafana/configure-security/configure-authentication/enhanced-ldap/#ldap-group-synchronization-for-teams" >}})
|
||||
- [Okta]({{< relref "../setup-grafana/configure-security/configure-authentication/okta/#team-sync-enterprise-only" >}})
|
||||
- [SAML]({{< relref "../setup-grafana/configure-security/configure-authentication/saml/#configure-team-sync" >}})
|
||||
|
||||
### Enhanced LDAP integration
|
||||
|
||||
With [enhanced LDAP integration]({{< relref "../setup-grafana/configure-security/configure-authentication/enhanced_ldap/" >}}), you can set up active LDAP synchronization.
|
||||
With [enhanced LDAP integration]({{< relref "../setup-grafana/configure-security/configure-authentication/enhanced-ldap/" >}}), you can set up active LDAP synchronization.
|
||||
|
||||
### SAML authentication
|
||||
|
||||
|
||||
@ -12,7 +12,7 @@ weight: 300
|
||||
|
||||
Custom branding allows you to replace the Grafana brand and logo with your own corporate brand and logo.
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../enterprise/" >}}) and [Grafana Cloud Advanced]({{< ref "/docs/grafana-cloud" >}}).
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced]({{< ref "/docs/grafana-cloud" >}}).
|
||||
|
||||
Grafana Enterprise has custom branding options in the `grafana.ini` file. As with all configuration options, you can also set them with environment variables.
|
||||
|
||||
@ -33,7 +33,7 @@ You can change the following elements:
|
||||
|
||||
{{< figure src="/static/img/docs/v66/whitelabeling_1.png" max-width="800px" caption="Custom branding example" >}}
|
||||
|
||||
The configuration file in Grafana Enterprise contains the following options. Each option is defined in the file. For more information about configuring Grafana, refer to [Configuration]({{< relref "../configure-grafana/" >}}).
|
||||
The configuration file in Grafana Enterprise contains the following options. Each option is defined in the file. For more information about configuring Grafana, refer to [Configuration]({{< relref "../../configure-grafana/" >}}).
|
||||
|
||||
```ini
|
||||
# Enterprise only
|
||||
@ -40,7 +40,7 @@ automatically. Defaults to `true`.
|
||||
|
||||
> **Note:** Available in Grafana Enterprise version 8.3 and later.
|
||||
|
||||
When set to `aws`, Grafana will validate its license status with Amazon Web Services (AWS) instead of with Grafana Labs. Only use this setting if you purchased an Enterprise license from AWS Marketplace. Defaults to empty, which means that by default Grafana Enterprise will validate using a license issued by Grafana Labs. For details about licenses issued by AWS, refer to [Activate a Grafana Enterprise license purchased through AWS Marketplace]({{< relref "../../administration/enterprise-licensing/activate-aws-marketplace-license/" >}}).
|
||||
When set to `aws`, Grafana will validate its license status with Amazon Web Services (AWS) instead of with Grafana Labs. Only use this setting if you purchased an Enterprise license from AWS Marketplace. Defaults to empty, which means that by default Grafana Enterprise will validate using a license issued by Grafana Labs. For details about licenses issued by AWS, refer to [Activate a Grafana Enterprise license purchased through AWS Marketplace]({{< relref "../../../administration/enterprise-licensing/activate-aws-marketplace-license/" >}}).
|
||||
|
||||
## [white_labeling]
|
||||
|
||||
@ -79,7 +79,7 @@ List the link IDs to use here. Grafana will look for matching link configuration
|
||||
|
||||
## [usage_insights.export]
|
||||
|
||||
By [exporting usage logs]({{< relref "../configure-security/export-logs/" >}}), you can directly query them and create dashboards of the information that matters to you most, such as dashboard errors, most active organizations, or your top-10 most-used queries.
|
||||
By [exporting usage logs]({{< relref "../../configure-security/export-logs/" >}}), you can directly query them and create dashboards of the information that matters to you most, such as dashboard errors, most active organizations, or your top-10 most-used queries.
|
||||
|
||||
### enabled
|
||||
|
||||
@ -163,7 +163,7 @@ Name of the TrueType font file with italic style.
|
||||
|
||||
## [auditing]
|
||||
|
||||
[Auditing]({{< relref "../configure-security/audit-grafana/" >}}) allows you to track important changes to your Grafana instance. By default, audit logs are logged to file but the auditing feature also supports sending logs directly to Loki.
|
||||
[Auditing]({{< relref "../../configure-security/audit-grafana/" >}}) allows you to track important changes to your Grafana instance. By default, audit logs are logged to file but the auditing feature also supports sending logs directly to Loki.
|
||||
|
||||
### enabled
|
||||
|
||||
@ -375,7 +375,7 @@ Setting 'enabled' to `true` allows users to configure query caching for data sou
|
||||
|
||||
This value is `true` by default.
|
||||
|
||||
> **Note:** This setting enables the caching feature, but it does not turn on query caching for any data source. To turn on query caching for a data source, update the setting on the data source configuration page. For more information, refer to the [query caching docs]({{< relref "../../enterprise/query-caching/#enable-and-configure-query-caching" >}}).
|
||||
> **Note:** This setting enables the caching feature, but it does not turn on query caching for any data source. To turn on query caching for a data source, update the setting on the data source configuration page. For more information, refer to the [query caching docs]({{< relref "../../../enterprise/query-caching/#enable-and-configure-query-caching" >}}).
|
||||
|
||||
### ttl
|
||||
|
||||
@ -13,7 +13,7 @@ weight: 100
|
||||
|
||||
Grafana provides many ways to authenticate users. Some authentication integrations also enable syncing user permissions and org memberships.
|
||||
|
||||
The following table shows all supported authentication providers and the features available for them. [Team sync]({{< relref "../configure-team-sync/" >}}) and [active sync]({{< relref "enhanced_ldap/#active-ldap-synchronization" >}}) are only available in Grafana Enterprise.
|
||||
The following table shows all supported authentication providers and the features available for them. [Team sync]({{< relref "../configure-team-sync/" >}}) and [active sync]({{< relref "enhanced-ldap/#active-ldap-synchronization" >}}) are only available in Grafana Enterprise.
|
||||
|
||||
| Provider | Support | Role mapping | Team sync<br> _(Enterprise only)_ | Active sync<br> _(Enterprise only)_ |
|
||||
| ------------------------------------------------ | :-----: | :----------: | :-------------------------------: | :---------------------------------: |
|
||||
|
||||
@ -241,7 +241,7 @@ headers = "Groups:X-WEBAUTH-GROUPS"
|
||||
|
||||
You use the `X-WEBAUTH-GROUPS` header to send the team information for each user. Specifically, the set of Grafana's group IDs that the user belongs to.
|
||||
|
||||
First, we need to set up the mapping between your authentication provider and Grafana. Follow [these instructions]({{< relref "../configure-team-sync/#enable-synchronization-for-a-team" >}}) to add groups to a team within Grafana.
|
||||
First, we need to set up the mapping between your authentication provider and Grafana. Follow [these instructions]({{< relref "../../configure-team-sync/#enable-synchronization-for-a-team" >}}) to add groups to a team within Grafana.
|
||||
|
||||
Once that's done. You can verify your mappings by querying the API.
|
||||
|
||||
@ -299,7 +299,7 @@ curl -H "X-WEBAUTH-USER: leonard" -H "X-WEBAUTH-GROUPS: lokiteamOnExternalSystem
|
||||
|
||||
With this, the user `leonard` will be automatically placed into the Loki team as part of Grafana authentication.
|
||||
|
||||
[Learn more about Team Sync]({{< relref "../configure-team-sync/" >}})
|
||||
[Learn more about Team Sync]({{< relref "../../configure-team-sync/" >}})
|
||||
|
||||
## Login token and session cookie
|
||||
|
||||
@ -105,7 +105,7 @@ To enable the Azure AD OAuth2, register your application with Azure AD.
|
||||
By default, Azure AD authentication will map users to organization roles based on the most privileged application role assigned to the user in AzureAD.
|
||||
|
||||
If no application role is found, the user is assigned the role specified by
|
||||
[the `auto_assign_org_role` option]({{< relref "../../configure-grafana#auto_assign_org_role" >}}).
|
||||
[the `auto_assign_org_role` option]({{< relref "../../../configure-grafana#auto_assign_org_role" >}}).
|
||||
You can disable this default role assignment by setting `role_attribute_strict = true`.
|
||||
It denies user access if no role or an invalid role is returned.
|
||||
|
||||
@ -114,7 +114,7 @@ their organization membership will be reset to the default organization.
|
||||
|
||||
If Azure AD authentication is not intended to sync user roles and organization membership,
|
||||
`oauth_skip_org_role_update_sync` should be enabled.
|
||||
See [configure-grafana]({{< relref "../../configure-grafana#oauth_skip_org_role_update_sync" >}}) for more details.
|
||||
See [configure-grafana]({{< relref "../../../configure-grafana#oauth_skip_org_role_update_sync" >}}) for more details.
|
||||
|
||||
### Assign server administrator privileges
|
||||
|
||||
@ -142,7 +142,7 @@ If the setting is set to `false`, the user is assigned the role of `Admin` of th
|
||||
|
||||
## Enable Azure AD OAuth in Grafana
|
||||
|
||||
1. Add the following to the [Grafana configuration file]({{< relref "../../configure-grafana/#config-file-locations" >}}):
|
||||
1. Add the following to the [Grafana configuration file]({{< relref "../../../configure-grafana/#config-file-locations" >}}):
|
||||
|
||||
```
|
||||
[auth.azuread]
|
||||
@ -167,7 +167,7 @@ GF_AUTH_AZUREAD_CLIENT_ID
|
||||
GF_AUTH_AZUREAD_CLIENT_SECRET
|
||||
```
|
||||
|
||||
**Note:** Verify that the Grafana [root_url]({{< relref "../../configure-grafana/#root-url" >}}) is set in your Azure Application Redirect URLs.
|
||||
**Note:** Verify that the Grafana [root_url]({{< relref "../../../configure-grafana/#root-url" >}}) is set in your Azure Application Redirect URLs.
|
||||
|
||||
### Configure allowed groups
|
||||
|
||||
@ -201,7 +201,7 @@ the correct teams.
|
||||
|
||||
You can reference Azure AD groups by group object ID, like `8bab1c86-8fba-33e5-2089-1d1c80ec267d`.
|
||||
|
||||
To learn more, refer to the [Team Sync]({{< relref "../configure-team-sync/" >}}) documentation.
|
||||
To learn more, refer to the [Team Sync]({{< relref "../../configure-team-sync/" >}}) documentation.
|
||||
|
||||
## Common troubleshooting
|
||||
|
||||
@ -2,6 +2,8 @@
|
||||
aliases:
|
||||
- /docs/grafana/latest/enterprise/enhanced_ldap/
|
||||
- /docs/grafana/latest/setup-grafana/configure-security/configure-authentication/enhanced_ldap/
|
||||
- /docs/grafana/latest/setup-grafana/configure-security/configure-authentication/enhanced-ldap/
|
||||
|
||||
description: Grafana Enhanced LDAP Integration Guide
|
||||
keywords:
|
||||
- grafana
|
||||
@ -18,9 +20,9 @@ weight: 900
|
||||
|
||||
The enhanced LDAP integration adds additional functionality on top of the [LDAP integration]({{< relref "ldap/" >}}) available in the open source edition of Grafana.
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../enterprise/" >}}) and [Grafana Cloud Advanced]({{< ref "/grafana-cloud" >}}).
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced]({{< ref "/grafana-cloud" >}}).
|
||||
|
||||
> To control user access with role-based permissions, refer to [role-based access control]({{< relref "../../../administration/roles-and-permissions/access-control/" >}}).
|
||||
> To control user access with role-based permissions, refer to [role-based access control]({{< relref "../../../../administration/roles-and-permissions/access-control/" >}}).
|
||||
|
||||
## LDAP group synchronization for teams
|
||||
|
||||
@ -33,7 +35,7 @@ Grafana keeps track of all synchronized users in teams, and you can see which us
|
||||
This mechanism allows Grafana to remove an existing synchronized user from a team when its LDAP group membership changes. This mechanism also allows you to manually add
|
||||
a user as member of a team, and it will not be removed when the user signs in. This gives you flexibility to combine LDAP group memberships and Grafana team memberships.
|
||||
|
||||
[Learn more about team sync.]({{< relref "../configure-team-sync/" >}})
|
||||
[Learn more about team sync.]({{< relref "../../configure-team-sync/" >}})
|
||||
|
||||
<div class="clearfix"></div>
|
||||
|
||||
@ -243,16 +243,16 @@ For more information, refer to the [JMESPath examples](#jmespath-examples).
|
||||
> **Warning**: Currently if no organization role mapping is found for a user, Grafana doesn't
|
||||
> update the user's organization role. This is going to change in Grafana 10. To avoid overriding manually set roles,
|
||||
> enable the `oauth_skip_org_role_update_sync` option.
|
||||
> See [configure-grafana]({{< relref "../../configure-grafana#oauth_skip_org_role_update_sync" >}}) for more information.
|
||||
> See [configure-grafana]({{< relref "../../../configure-grafana#oauth_skip_org_role_update_sync" >}}) for more information.
|
||||
|
||||
On first login, if the`role_attribute_path` property does not return a role, then the user is assigned the role
|
||||
specified by [the `auto_assign_org_role` option]({{< relref "../../configure-grafana#auto_assign_org_role" >}}).
|
||||
specified by [the `auto_assign_org_role` option]({{< relref "../../../configure-grafana#auto_assign_org_role" >}}).
|
||||
You can disable this default role assignment by setting `role_attribute_strict = true`.
|
||||
It denies user access if no role or an invalid role is returned.
|
||||
|
||||
> **Warning**: With Grafana 10, **on every login**, if the`role_attribute_path` property does not return a role,
|
||||
> then the user is assigned the role specified by
|
||||
> [the `auto_assign_org_role` option]({{< relref "../../configure-grafana#auto_assign_org_role" >}}).
|
||||
> [the `auto_assign_org_role` option]({{< relref "../../../configure-grafana#auto_assign_org_role" >}}).
|
||||
|
||||
### JMESPath examples
|
||||
|
||||
@ -336,7 +336,7 @@ With Team Sync you can map your Generic OAuth groups to teams in Grafana so that
|
||||
|
||||
Generic OAuth groups can be referenced by group ID, like `8bab1c86-8fba-33e5-2089-1d1c80ec267d` or `myteam`.
|
||||
|
||||
[Learn more about Team Sync]({{< relref "../configure-team-sync/" >}})
|
||||
[Learn more about Team Sync]({{< relref "../../configure-team-sync/" >}})
|
||||
|
||||
Config:
|
||||
|
||||
@ -60,7 +60,7 @@ You may allow users to sign-up via GitHub authentication by setting the
|
||||
user successfully authenticating via GitHub authentication will be
|
||||
automatically signed up.
|
||||
|
||||
You can also use [variable expansion]({{< relref "../../configure-grafana/#variable-expansion" >}}) to reference environment variables and local files in your GitHub auth configuration.
|
||||
You can also use [variable expansion]({{< relref "../../../configure-grafana/#variable-expansion" >}}) to reference environment variables and local files in your GitHub auth configuration.
|
||||
|
||||
### team_ids
|
||||
|
||||
@ -109,21 +109,21 @@ You can use GitHub OAuth to map roles. During mapping, Grafana checks for the pr
|
||||
|
||||
For the path lookup, Grafana uses JSON obtained from querying GitHub's API [`/api/user`](https://docs.github.com/en/rest/users/users#get-the-authenticated-user=) endpoint and a `groups` key containing all of the user's teams (retrieved from `/api/user/teams`).
|
||||
|
||||
The result of evaluating the `role_attribute_path` JMESPath expression must be a valid Grafana role, for example, `Viewer`, `Editor` or `Admin`. For more information about roles and permissions in Grafana, refer to [Roles and permissions]({{< relref "../../../administration/roles-and-permissions/" >}}).
|
||||
The result of evaluating the `role_attribute_path` JMESPath expression must be a valid Grafana role, for example, `Viewer`, `Editor` or `Admin`. For more information about roles and permissions in Grafana, refer to [Roles and permissions]({{< relref "../../../../administration/roles-and-permissions/" >}}).
|
||||
|
||||
> **Warning**: Currently if no organization role mapping is found for a user, Grafana doesn't
|
||||
> update the user's organization role. This is going to change in Grafana 10. To avoid overriding manually set roles,
|
||||
> enable the `oauth_skip_org_role_update_sync` option.
|
||||
> See [configure-grafana]({{< relref "../../configure-grafana#oauth_skip_org_role_update_sync" >}}) for more information.
|
||||
> See [configure-grafana]({{< relref "../../../configure-grafana#oauth_skip_org_role_update_sync" >}}) for more information.
|
||||
|
||||
On first login, if the`role_attribute_path` property does not return a role, then the user is assigned the role
|
||||
specified by [the `auto_assign_org_role` option]({{< relref "../../configure-grafana#auto_assign_org_role" >}}).
|
||||
specified by [the `auto_assign_org_role` option]({{< relref "../../../configure-grafana#auto_assign_org_role" >}}).
|
||||
You can disable this default role assignment by setting `role_attribute_strict = true`.
|
||||
It denies user access if no role or an invalid role is returned.
|
||||
|
||||
> **Warning**: With Grafana 10, **on every login**, if the`role_attribute_path` property does not return a role,
|
||||
> then the user is assigned the role specified by
|
||||
> [the `auto_assign_org_role` option]({{< relref "../../configure-grafana#auto_assign_org_role" >}}).
|
||||
> [the `auto_assign_org_role` option]({{< relref "../../../configure-grafana#auto_assign_org_role" >}}).
|
||||
|
||||
An example Query could look like the following:
|
||||
|
||||
@ -181,4 +181,4 @@ Your GitHub teams can be referenced in two ways:
|
||||
|
||||
Example: `@grafana/developers`
|
||||
|
||||
[Learn more about Team Sync]({{< relref "../configure-team-sync/" >}})
|
||||
[Learn more about Team Sync]({{< relref "../../configure-team-sync/" >}})
|
||||
@ -127,21 +127,21 @@ allow_assign_grafana_admin = false
|
||||
|
||||
You can use GitLab OAuth to map roles. During mapping, Grafana checks for the presence of a role using the [JMESPath](http://jmespath.org/examples.html) specified via the `role_attribute_path` configuration option.
|
||||
|
||||
For the path lookup, Grafana uses JSON obtained from querying GitLab's API [`/api/v4/user`](https://docs.gitlab.com/ee/api/users.html#list-current-user-for-normal-users) endpoint and a `groups` key containing all of the user's teams. The result of evaluating the `role_attribute_path` JMESPath expression must be a valid Grafana role, for example, `Viewer`, `Editor` or `Admin`. For more information about roles and permissions in Grafana, refer to [Roles and permissions]({{< relref "../../../administration/roles-and-permissions/" >}}).
|
||||
For the path lookup, Grafana uses JSON obtained from querying GitLab's API [`/api/v4/user`](https://docs.gitlab.com/ee/api/users.html#list-current-user-for-normal-users) endpoint and a `groups` key containing all of the user's teams. The result of evaluating the `role_attribute_path` JMESPath expression must be a valid Grafana role, for example, `Viewer`, `Editor` or `Admin`. For more information about roles and permissions in Grafana, refer to [Roles and permissions]({{< relref "../../../../administration/roles-and-permissions/" >}}).
|
||||
|
||||
> **Warning**: Currently if no organization role mapping is found for a user, Grafana doesn't
|
||||
> update the user's organization role. This is going to change in Grafana 10. To avoid overriding manually set roles,
|
||||
> enable the `oauth_skip_org_role_update_sync` option.
|
||||
> See [configure-grafana]({{< relref "../../configure-grafana#oauth_skip_org_role_update_sync" >}}) for more information.
|
||||
> See [configure-grafana]({{< relref "../../../configure-grafana#oauth_skip_org_role_update_sync" >}}) for more information.
|
||||
|
||||
On first login, if the`role_attribute_path` property does not return a role, then the user is assigned the role
|
||||
specified by [the `auto_assign_org_role` option]({{< relref "../../configure-grafana#auto_assign_org_role" >}}).
|
||||
specified by [the `auto_assign_org_role` option]({{< relref "../../../configure-grafana#auto_assign_org_role" >}}).
|
||||
You can disable this default role assignment by setting `role_attribute_strict = true`.
|
||||
It denies user access if no role or an invalid role is returned.
|
||||
|
||||
> **Warning**: With Grafana 10, **on every login**, if the`role_attribute_path` property does not return a role,
|
||||
> then the user is assigned the role specified by
|
||||
> [the `auto_assign_org_role` option]({{< relref "../../configure-grafana#auto_assign_org_role" >}}).
|
||||
> [the `auto_assign_org_role` option]({{< relref "../../../configure-grafana#auto_assign_org_role" >}}).
|
||||
|
||||
An example Query could look like the following:
|
||||
|
||||
@ -194,4 +194,4 @@ the correct teams.
|
||||
|
||||
Your GitLab groups can be referenced in the same way as `allowed_groups`, like `example` or `foo/bar`.
|
||||
|
||||
[Learn more about Team Sync]({{< relref "../configure-team-sync/" >}})
|
||||
[Learn more about Team Sync]({{< relref "../../configure-team-sync/" >}})
|
||||
@ -28,7 +28,7 @@ First, you need to create a Google OAuth Client:
|
||||
|
||||
## Enable Google OAuth in Grafana
|
||||
|
||||
Specify the Client ID and Secret in the [Grafana configuration file]({{< relref "../../configure-grafana/#config-file-locations" >}}). For example:
|
||||
Specify the Client ID and Secret in the [Grafana configuration file]({{< relref "../../../configure-grafana/#config-file-locations" >}}). For example:
|
||||
|
||||
```bash
|
||||
[auth.google]
|
||||
@ -126,7 +126,7 @@ signout_redirect_url =
|
||||
|
||||
### Protected roles
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../introduction/grafana-enterprise" >}}) and [Grafana Cloud Advanced]({{< relref "../../../introduction/grafana-cloud" >}}).
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise" >}}) and [Grafana Cloud Advanced]({{< relref "../../../../introduction/grafana-cloud" >}}).
|
||||
|
||||
By default, after you configure an authorization provider, Grafana will adopt existing users into the new authentication scheme. For example, if you have created a user with basic authentication having the login `jsmith@example.com`, then set up SAML authentication where `jsmith@example.com` is an account, the user's authentication type will be changed to SAML if they perform a SAML sign-in.
|
||||
|
||||
@ -23,7 +23,7 @@ authentication in an app embedding Grafana.
|
||||
|
||||
To use JWT authentication:
|
||||
|
||||
1. Enable JWT in the [main config file]({{< relref "../../configure-grafana/" >}}).
|
||||
1. Enable JWT in the [main config file]({{< relref "../../../configure-grafana/" >}}).
|
||||
1. Specify the header name that contains a token.
|
||||
|
||||
```ini
|
||||
@ -63,13 +63,13 @@ If you want to embed Grafana in an iframe while maintaning user identity and rol
|
||||
you can use JWT authentication to authenticate the iframe.
|
||||
|
||||
> **Note**: For Grafana Cloud, or scenarios where verifying viewer identity is not required,
|
||||
> embed [public dashboards]({{< relref "../../../dashboards/dashboard-public" >}}).
|
||||
> embed [public dashboards]({{< relref "../../../../dashboards/dashboard-public" >}}).
|
||||
|
||||
In this scenario, you will need to configure Grafana to accept a JWT
|
||||
provided in the HTTP header and a reverse proxy should rewrite requests to the
|
||||
Grafana instance to include the JWT in the request's headers.
|
||||
|
||||
> **Note**: For embedding to work, you must enable `allow_embedding` in the [security section]({{< relref "../../configure-grafana#allow_embedding" >}}). This setting is not available in Grafana Cloud.
|
||||
> **Note**: For embedding to work, you must enable `allow_embedding` in the [security section]({{< relref "../../../configure-grafana#allow_embedding" >}}). This setting is not available in Grafana Cloud.
|
||||
|
||||
In a scenario where it is not possible to rewrite the request headers you
|
||||
can use URL login instead.
|
||||
@ -13,9 +13,9 @@ weight: 800
|
||||
The LDAP integration in Grafana allows your Grafana users to login with their LDAP credentials. You can also specify mappings between LDAP
|
||||
group memberships and Grafana Organization user roles.
|
||||
|
||||
> [Enhanced LDAP authentication]({{< relref "enhanced_ldap/" >}}) is available in [Grafana Cloud Advanced](https://grafana.com/docs/grafana-cloud/) and in [Grafana Enterprise]({{< relref "../../../enterprise/" >}}).
|
||||
> [Enhanced LDAP authentication]({{< relref "../enhanced-ldap/" >}}) is available in [Grafana Cloud Advanced](https://grafana.com/docs/grafana-cloud/) and in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise/" >}}).
|
||||
|
||||
> Refer to [Role-based access control]({{< relref "../../../administration/roles-and-permissions/access-control/" >}}) to understand how you can control access with role-based permissions.
|
||||
> Refer to [Role-based access control]({{< relref "../../../../administration/roles-and-permissions/access-control/" >}}) to understand how you can control access with role-based permissions.
|
||||
|
||||
## Supported LDAP Servers
|
||||
|
||||
@ -25,7 +25,7 @@ This means that you should be able to configure LDAP integration using any compl
|
||||
|
||||
## Enable LDAP
|
||||
|
||||
In order to use LDAP integration you'll first need to enable LDAP in the [main config file]({{< relref "../../configure-grafana/" >}}) as well as specify the path to the LDAP
|
||||
In order to use LDAP integration you'll first need to enable LDAP in the [main config file]({{< relref "../../../configure-grafana/" >}}) as well as specify the path to the LDAP
|
||||
specific configuration file (default: `/etc/grafana/ldap.toml`).
|
||||
|
||||
```ini
|
||||
@ -141,7 +141,7 @@ To use the debug view:
|
||||
|
||||
{{< figure src="/static/img/docs/ldap_debug_mapping_testing.png" class="docs-image--no-shadow" max-width="600px" >}}
|
||||
|
||||
[Grafana Enterprise]({{< relref "../../../introduction/grafana-enterprise" >}}) users with [enhanced LDAP integration]({{< relref "enhanced_ldap" >}}) enabled can also see sync status in the debug view. This requires the `ldap.status:read` permission.
|
||||
[Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise" >}}) users with [enhanced LDAP integration]({{< relref "../enhanced-ldap" >}}) enabled can also see sync status in the debug view. This requires the `ldap.status:read` permission.
|
||||
|
||||
{{< figure src="/static/img/docs/ldap_sync_debug.png" class="docs-image--no-shadow" max-width="600px" >}}
|
||||
|
||||
@ -393,7 +393,7 @@ Please inspect your Active Directory configuration and documentation to find the
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
To troubleshoot and get more log info enable LDAP debug logging in the [main config file]({{< relref "../../configure-grafana/" >}}).
|
||||
To troubleshoot and get more log info enable LDAP debug logging in the [main config file]({{< relref "../../../configure-grafana/" >}}).
|
||||
|
||||
```bash
|
||||
[log]
|
||||
@ -35,7 +35,7 @@ Before you can sign a user in, you need to create an Okta application from the O
|
||||
|
||||
## Enable Okta OAuth in Grafana
|
||||
|
||||
1. Add the following to the [Grafana configuration file]({{< relref "../../configure-grafana/#config-file-locations" >}}):
|
||||
1. Add the following to the [Grafana configuration file]({{< relref "../../../configure-grafana/#config-file-locations" >}}):
|
||||
|
||||
```ini
|
||||
[auth.okta]
|
||||
@ -73,21 +73,21 @@ allowed_domains = mycompany.com mycompany.org
|
||||
|
||||
Grafana can attempt to do role mapping through Okta OAuth. In order to achieve this, Grafana checks for the presence of a role using the [JMESPath](http://jmespath.org/examples.html) specified via the `role_attribute_path` configuration option.
|
||||
|
||||
Grafana uses JSON obtained from querying the `/userinfo` endpoint for the path lookup. The result after evaluating the `role_attribute_path` JMESPath expression needs to be a valid Grafana role, i.e. `Viewer`, `Editor` or `Admin`. For more information about roles and permissions in Grafana, refer to [Roles and permissions]({{< relref "../../../administration/roles-and-permissions/" >}}).
|
||||
Grafana uses JSON obtained from querying the `/userinfo` endpoint for the path lookup. The result after evaluating the `role_attribute_path` JMESPath expression needs to be a valid Grafana role, i.e. `Viewer`, `Editor` or `Admin`. For more information about roles and permissions in Grafana, refer to [Roles and permissions]({{< relref "../../../../administration/roles-and-permissions/" >}}).
|
||||
|
||||
> **Warning**: Currently if no organization role mapping is found for a user, Grafana doesn't
|
||||
> update the user's organization role. This is going to change in Grafana 10. To avoid overriding manually set roles,
|
||||
> enable the `oauth_skip_org_role_update_sync` option.
|
||||
> See [configure-grafana]({{< relref "../../configure-grafana#oauth_skip_org_role_update_sync" >}}) for more information.
|
||||
> See [configure-grafana]({{< relref "../../../configure-grafana#oauth_skip_org_role_update_sync" >}}) for more information.
|
||||
|
||||
On first login, if the`role_attribute_path` property does not return a role, then the user is assigned the role
|
||||
specified by [the `auto_assign_org_role` option]({{< relref "../../configure-grafana#auto_assign_org_role" >}}).
|
||||
specified by [the `auto_assign_org_role` option]({{< relref "../../../configure-grafana#auto_assign_org_role" >}}).
|
||||
You can disable this default role assignment by setting `role_attribute_strict = true`.
|
||||
It denies user access if no role or an invalid role is returned.
|
||||
|
||||
> **Warning**: With Grafana 10, **on every login**, if the`role_attribute_path` property does not return a role,
|
||||
> then the user is assigned the role specified by
|
||||
> [the `auto_assign_org_role` option]({{< relref "../../configure-grafana#auto_assign_org_role" >}}).
|
||||
> [the `auto_assign_org_role` option]({{< relref "../../../configure-grafana#auto_assign_org_role" >}}).
|
||||
|
||||
Read about how to [add custom claims](https://developer.okta.com/docs/guides/customize-tokens-returned-from-okta/add-custom-claim/) to the user info in Okta. Also, check Generic OAuth page for [JMESPath examples]({{< relref "generic-oauth/#jmespath-examples" >}}).
|
||||
|
||||
@ -119,4 +119,4 @@ the correct teams.
|
||||
|
||||
Okta groups can be referenced by group name, like `Admins`.
|
||||
|
||||
[Learn more about Team Sync]({{< relref "../configure-team-sync/" >}})
|
||||
[Learn more about Team Sync]({{< relref "../../configure-team-sync/" >}})
|
||||
@ -21,7 +21,7 @@ SAML authentication integration allows your Grafana users to log in by using an
|
||||
|
||||
The SAML single sign-on (SSO) standard is varied and flexible. Our implementation contains a subset of features needed to provide a smooth authentication experience into Grafana.
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../enterprise/" >}}) and [Grafana Cloud Pro and Advanced]({{< ref "/docs/grafana-cloud" >}}).
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Pro and Advanced]({{< ref "/docs/grafana-cloud" >}}).
|
||||
|
||||
## Supported SAML
|
||||
|
||||
@ -49,15 +49,15 @@ By default, SP-initiated requests are enabled. For instructions on how to enable
|
||||
|
||||
### Edit SAML options in the Grafana config file
|
||||
|
||||
1. In the `[auth.saml]` section in the Grafana configuration file, set [`enabled`]({{< relref "../../configure-grafana/enterprise-configuration/#enabled" >}}) to `true`.
|
||||
1. In the `[auth.saml]` section in the Grafana configuration file, set [`enabled`]({{< relref "../../../configure-grafana/enterprise-configuration/#enabled" >}}) to `true`.
|
||||
1. Configure the [certificate and private key]({{< relref "#certificate-and-private-key" >}}).
|
||||
1. On the Okta application page where you have been redirected after application created, navigate to the **Sign On** tab and find **Identity Provider metadata** link in the **Settings** section.
|
||||
1. Set the [`idp_metadata_url`]({{< relref "../../configure-grafana/enterprise-configuration/#idp_metadata_url" >}}) to the URL obtained from the previous step. The URL should look like `https://<your-org-id>.okta.com/app/<application-id>/sso/saml/metadata`.
|
||||
1. Set the [`idp_metadata_url`]({{< relref "../../../configure-grafana/enterprise-configuration/#idp_metadata_url" >}}) to the URL obtained from the previous step. The URL should look like `https://<your-org-id>.okta.com/app/<application-id>/sso/saml/metadata`.
|
||||
1. Set the following options to the attribute names configured at the **step 10** of the SAML integration setup. You can find this attributes on the **General** tab of the application page (**ATTRIBUTE STATEMENTS** and **GROUP ATTRIBUTE STATEMENTS** in the **SAML Settings** section).
|
||||
- [`assertion_attribute_login`]({{< relref "../../configure-grafana/enterprise-configuration/#assertion-attribute-login" >}})
|
||||
- [`assertion_attribute_email`]({{< relref "../../configure-grafana/enterprise-configuration/#assertion-attribute-email" >}})
|
||||
- [`assertion_attribute_name`]({{< relref "../../configure-grafana/enterprise-configuration/#assertion-attribute-name" >}})
|
||||
- [`assertion_attribute_groups`]({{< relref "../../configure-grafana/enterprise-configuration/#assertion-attribute-groups" >}})
|
||||
- [`assertion_attribute_login`]({{< relref "../../../configure-grafana/enterprise-configuration/#assertion-attribute-login" >}})
|
||||
- [`assertion_attribute_email`]({{< relref "../../../configure-grafana/enterprise-configuration/#assertion-attribute-email" >}})
|
||||
- [`assertion_attribute_name`]({{< relref "../../../configure-grafana/enterprise-configuration/#assertion-attribute-name" >}})
|
||||
- [`assertion_attribute_groups`]({{< relref "../../../configure-grafana/enterprise-configuration/#assertion-attribute-groups" >}})
|
||||
1. Save the configuration file and and then restart the Grafana server.
|
||||
|
||||
When you are finished, the Grafana configuration might look like this example:
|
||||
@ -81,7 +81,7 @@ assertion_attribute_groups = Group
|
||||
|
||||
To use the SAML integration, in the `auth.saml` section of in the Grafana custom configuration file, set `enabled` to `true`.
|
||||
|
||||
Refer to [Configuration]({{< relref "../../configure-grafana/" >}}) for more information about configuring Grafana.
|
||||
Refer to [Configuration]({{< relref "../../../configure-grafana/" >}}) for more information about configuring Grafana.
|
||||
|
||||
## Certificate and private key
|
||||
|
||||
@ -130,7 +130,7 @@ Grafana supports user authentication through Okta, which is useful when you want
|
||||
**Before you begin:**
|
||||
|
||||
- To configure SAML integration with Okta, create integration inside the Okta organization first. [Add integration in Okta](https://help.okta.com/en/prod/Content/Topics/Apps/apps-overview-add-apps.htm)
|
||||
- Ensure you have permission to administer SAML authentication. For more information about roles and permissions in Grafana, refer to [Roles and permissions]({{< relref "../../../administration/roles-and-permissions/" >}}).
|
||||
- Ensure you have permission to administer SAML authentication. For more information about roles and permissions in Grafana, refer to [Roles and permissions]({{< relref "../../../../administration/roles-and-permissions/" >}}).
|
||||
|
||||
**To set up SAML with Okta:**
|
||||
|
||||
@ -163,7 +163,7 @@ Grafana supports user authentication through Okta, which is useful when you want
|
||||
|
||||
## Configure SAML authentication in Grafana
|
||||
|
||||
The table below describes all SAML configuration options. Continue reading below for details on specific options. Like any other Grafana configuration, you can apply these options as [environment variables]({{< relref "../../configure-grafana/#override-configuration-with-environment-variables" >}}).
|
||||
The table below describes all SAML configuration options. Continue reading below for details on specific options. Like any other Grafana configuration, you can apply these options as [environment variables]({{< relref "../../../configure-grafana/#override-configuration-with-environment-variables" >}}).
|
||||
|
||||
| Setting | Required | Description | Default |
|
||||
| ---------------------------------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------- |
|
||||
@ -276,24 +276,24 @@ By default, new Grafana users using SAML authentication will have an account cre
|
||||
|
||||
> **Note:** Team sync support for SAML is available in Grafana version 7.0 and later.
|
||||
|
||||
To use SAML Team sync, set [`assertion_attribute_groups`]({{< relref "../../configure-grafana/enterprise-configuration/#assertion-attribute-groups" >}}) to the attribute name where you store user groups. Then Grafana will use attribute values extracted from SAML assertion to add user into the groups with the same name configured on the External group sync tab.
|
||||
To use SAML Team sync, set [`assertion_attribute_groups`]({{< relref "../../../configure-grafana/enterprise-configuration/#assertion-attribute-groups" >}}) to the attribute name where you store user groups. Then Grafana will use attribute values extracted from SAML assertion to add user into the groups with the same name configured on the External group sync tab.
|
||||
|
||||
[Learn more about Team Sync]({{< relref "../configure-team-sync/" >}})
|
||||
[Learn more about Team Sync]({{< relref "../../configure-team-sync/" >}})
|
||||
|
||||
### Configure role sync
|
||||
|
||||
> **Note:** Available in Grafana version 7.0 and later.
|
||||
|
||||
Role sync allows you to map user roles from an identity provider to Grafana. To enable role sync, configure role attribute and possible values for the Editor, Admin, and Grafana Admin roles. For more information about user roles, refer to [Roles and permissions]({{< relref "../../../administration/roles-and-permissions/" >}}).
|
||||
Role sync allows you to map user roles from an identity provider to Grafana. To enable role sync, configure role attribute and possible values for the Editor, Admin, and Grafana Admin roles. For more information about user roles, refer to [Roles and permissions]({{< relref "../../../../administration/roles-and-permissions/" >}}).
|
||||
|
||||
1. In the configuration file, set [`assertion_attribute_role`]({{< relref "../../configure-grafana/enterprise-configuration/#assertion-attribute-role" >}}) option to the attribute name where the role information will be extracted from.
|
||||
1. Set the [`role_values_editor`]({{< relref "../../configure-grafana/enterprise-configuration/#role-values-editor" >}}) option to the values mapped to the `Editor` role.
|
||||
1. Set the [`role_values_admin`]({{< relref "../../configure-grafana/enterprise-configuration/#role-values-admin" >}}) option to the values mapped to the organization `Admin` role.
|
||||
1. Set the [`role_values_grafana_admin`]({{< relref "../../configure-grafana/enterprise-configuration/#role-values-grafana-admin" >}}) option to the values mapped to the `Grafana Admin` role.
|
||||
1. In the configuration file, set [`assertion_attribute_role`]({{< relref "../../../configure-grafana/enterprise-configuration/#assertion-attribute-role" >}}) option to the attribute name where the role information will be extracted from.
|
||||
1. Set the [`role_values_editor`]({{< relref "../../../configure-grafana/enterprise-configuration/#role-values-editor" >}}) option to the values mapped to the `Editor` role.
|
||||
1. Set the [`role_values_admin`]({{< relref "../../../configure-grafana/enterprise-configuration/#role-values-admin" >}}) option to the values mapped to the organization `Admin` role.
|
||||
1. Set the [`role_values_grafana_admin`]({{< relref "../../../configure-grafana/enterprise-configuration/#role-values-grafana-admin" >}}) option to the values mapped to the `Grafana Admin` role.
|
||||
|
||||
If a user role doesn't match any of configured values, then the `Viewer` role will be assigned.
|
||||
|
||||
For more information about roles and permissions in Grafana, refer to [Roles and permissions]({{< relref "../../../administration/roles-and-permissions/" >}}).
|
||||
For more information about roles and permissions in Grafana, refer to [Roles and permissions]({{< relref "../../../../administration/roles-and-permissions/" >}}).
|
||||
|
||||
Example configuration:
|
||||
|
||||
@ -324,8 +324,8 @@ skip_org_role_sync = true
|
||||
|
||||
Organization mapping allows you to assign users to particular organization in Grafana depending on attribute value obtained from identity provider.
|
||||
|
||||
1. In configuration file, set [`assertion_attribute_org`]({{< relref "../../configure-grafana/enterprise-configuration/#assertion-attribute-org" >}}) to the attribute name you store organization info in. This attribute can be an array if you want a user to be in multiple organizations.
|
||||
1. Set [`org_mapping`]({{< relref "../../configure-grafana/enterprise-configuration/#org-mapping" >}}) option to the comma-separated list of `Organization:OrgId` pairs to map organization from IdP to Grafana organization specified by id. If you want users to have different roles in multiple organizations, you can set this option to a comma-separated list of `Organization:OrgId:Role` mappings.
|
||||
1. In configuration file, set [`assertion_attribute_org`]({{< relref "../../../configure-grafana/enterprise-configuration/#assertion-attribute-org" >}}) to the attribute name you store organization info in. This attribute can be an array if you want a user to be in multiple organizations.
|
||||
1. Set [`org_mapping`]({{< relref "../../../configure-grafana/enterprise-configuration/#org-mapping" >}}) option to the comma-separated list of `Organization:OrgId` pairs to map organization from IdP to Grafana organization specified by id. If you want users to have different roles in multiple organizations, you can set this option to a comma-separated list of `Organization:OrgId:Role` mappings.
|
||||
|
||||
For example, use following configuration to assign users from `Engineering` organization to the Grafana organization with id `2` as Editor and users from `Sales` - to the org with id `3` as Admin, based on `Org` assertion attribute value:
|
||||
|
||||
@ -355,7 +355,7 @@ You can use `*` as the Grafana organization in the mapping if you want all users
|
||||
|
||||
> **Note:** Available in Grafana version 7.0 and later.
|
||||
|
||||
With the [`allowed_organizations`]({{< relref "../../configure-grafana/enterprise-configuration/#allowed-organizations" >}}) option you can specify a list of organizations where the user must be a member of at least one of them to be able to log in to Grafana.
|
||||
With the [`allowed_organizations`]({{< relref "../../../configure-grafana/enterprise-configuration/#allowed-organizations" >}}) option you can specify a list of organizations where the user must be a member of at least one of them to be able to log in to Grafana.
|
||||
|
||||
### Example SAML configuration
|
||||
|
||||
@ -383,7 +383,7 @@ allowed_organizations = Engineering, Sales
|
||||
|
||||
## Troubleshoot SAML authentication in Grafana
|
||||
|
||||
To troubleshoot and get more log information, enable SAML debug logging in the configuration file. Refer to [Configuration]({{< relref "../../configure-grafana/#filters" >}}) for more information.
|
||||
To troubleshoot and get more log information, enable SAML debug logging in the configuration file. Refer to [Configuration]({{< relref "../../../configure-grafana/#filters" >}}) for more information.
|
||||
|
||||
```bash
|
||||
[log]
|
||||
@ -435,7 +435,7 @@ The keys you provide should look like:
|
||||
|
||||
When the user logs in using SAML and gets presented with "origin not allowed", the user might be issuing the login from an IdP (identity provider) service or the user is behind a reverse proxy. This potentially happens as Grafana's CSRF checks deem the requests to be invalid. For more information [CSRF](https://owasp.org/www-community/attacks/csrf).
|
||||
|
||||
To solve this issue, you can configure either the [`csrf_trusted_origins`]({{< relref "../../configure-grafana/#csrf-trusted-origins" >}}) or [`csrf_additional_headers`]({{< relref "../../configure-grafana/#csrf_additional_headers" >}}) option in the SAML configuration.
|
||||
To solve this issue, you can configure either the [`csrf_trusted_origins`]({{< relref "../../../configure-grafana/#csrf-trusted-origins" >}}) or [`csrf_additional_headers`]({{< relref "../../../configure-grafana/#csrf_additional_headers" >}}) option in the SAML configuration.
|
||||
|
||||
Example of a configuration file:
|
||||
|
||||
@ -29,7 +29,7 @@ This mechanism allows Grafana to remove an existing synchronized user from a tea
|
||||
- [Azure AD]({{< relref "configure-authentication/azuread/#team-sync-enterprise-only" >}})
|
||||
- [GitHub OAuth]({{< relref "configure-authentication/github/#team-sync-enterprise-only" >}})
|
||||
- [GitLab OAuth]({{< relref "configure-authentication/gitlab/#team-sync-enterprise-only" >}})
|
||||
- [LDAP]({{< relref "configure-authentication/enhanced_ldap/#ldap-group-synchronization-for-teams" >}})
|
||||
- [LDAP]({{< relref "configure-authentication/enhanced-ldap/#ldap-group-synchronization-for-teams" >}})
|
||||
- [Okta]({{< relref "configure-authentication/okta/#team-sync-enterprise-only" >}})
|
||||
- [SAML]({{< relref "configure-authentication/saml/#configure-team-sync" >}})
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user