Add complete, tested RBAC HTTP API examples for updating basic role
permissions in the manage-rbac-roles page, including removing Grafana
Assistant access from the Viewer role. Document the per-instance and
all-orgs caveats and the No Basic Role alternative. Improve the Terraform
provisioning examples with env-var auth and a realistic custom role, and
link the RBAC rollout strategy doc from both pages.
Remove deprecated support bundle documentation.
Support bundles are deprecated, so drop the user and contributor guides and the troubleshooting index link.
* Docs: align RBAC annotation scopes with toggle removal
Update RBAC role and scope documentation to remove deprecated dashboard annotation scope and fixed role references after annotationPermissionUpdate cleanup in #117213.
* Docs: apply Prettier formatting for fixed role definitions
Normalize markdown table spacing in the RBAC fixed basic role definitions page so docs formatting checks pass consistently.
* remove annotations:type:* entries
* reduce memory usage of GroupScopesByActionContext
* optimize GroupScopesByActionContext for both speed and memory
Use hybrid approach: index caching for speed + single backing array for
memory efficiency. Uses uint16 indices (2 bytes) to minimize overhead
while supporting up to 65535 unique actions.
Benchmark results vs main:
- ~15% faster execution
- ~29% less memory at scale (large workloads)
- 82% fewer allocations (18 vs 102)
Benchmark results vs previous memory-only optimization:
- ~2x faster execution
- Constant allocation count regardless of action count
- Slightly more memory due to indices array, but much better speed
* gofmt
* docs: improve RBAC and role creation documentation
- Clarify that file-based RBAC provisioning is for self-managed instances only
- Distinguish between Grafana Admin (Server Admin) and Org Admin
- Remove incorrect UI instructions for custom role creation
- Add Terraform example for creating custom roles and assignments
* Apply suggestions from code review
Co-authored-by: Anna Urbiztondo <anna.urbiztondo@grafana.com>
---------
Co-authored-by: Anna Urbiztondo <anna.urbiztondo@grafana.com>
* Add delete and update hooks for roles/core roles
no need to capture non reference types
small cleanup on vars
* fix ticket priming in hooks
* fix ticket priming in hooks
* Revert "fix ticket priming in hooks"
This reverts commit f8e953ca09.
* use old testing blocks
* protect runtime obj in go func
* update test for correctness
* separate files for test correctness. fix leaking goroutines in go tests
* go workspace fixes
* attribute owner
* clean up go mod
* AccessControl: Include hidden roles in service account role fetches
Add includeHidden=true parameter to role API calls to ensure service accounts
with hidden roles assigned properly display those roles in the UI.
Previously, service accounts with only hidden roles would appear to have no
roles assigned in the UI, even though the API showed they had roles when
queried with includeHidden=true.
This change affects both:
- Bulk role fetching for the service accounts list
- Individual user role fetching used by the role picker
* format
As part of migrating Grafana's authorization system to Zanzana (OpenFGA), we need to ensure that role permissions defined in the IAM API are automatically synced to the authorization backend. Without this sync, roles created through the API would not be enforced by Zanzana, creating an inconsistency between defined permissions and actual authorization decisions.
This is a critical piece of the dual-write pattern during the migration to Zanzana, ensuring that:
Role permissions are immediately available for authorization checks
The legacy RBAC system and new Zanzana system remain in sync
Users experience consistent permission enforcement regardless of which backend is queried
safe to revert
* Add access token as third source for user info extraction
- Add extractFromAccessToken method to extract user info from JWT access tokens
- Mutualize code by creating parseUserInfoFromJSON helper method
- Rename methods for clarity: extractFromToken -> extractFromIDToken, retrieveRawIDToken -> retrieveRawJWTPayload
- Update test suite to include comprehensive access token retrieval scenarios
- Support three sources in priority order: ID token, API response, access token
- Maintain backward compatibility while adding new functionality
* Update Generic OAuth documentation to reflect access token support
- Add access token as a third source for user information extraction
- Update configuration sections to mention access tokens alongside ID tokens and UserInfo endpoint
- Document the priority order: ID token → UserInfo endpoint → access token
- Update configuration option descriptions to reflect new functionality
- Maintain consistency with implementation changes
* Refactor access token test cases to use parameter instead of hardcoded logic
- Add AccessToken field to test case struct for explicit access token specification
- Remove hardcoded string matching logic that determined access token based on test name
- Update all access token test cases to include the AccessToken field with appropriate JWT values
- Improve test maintainability and clarity by making access tokens explicit parameters
- Remove unused strings import that was only needed for the hardcoded logic
* fix doc lint
* reduce cyclomatic complexity
* Fix organization deletion error messages
- Improve error message clarity when attempting to delete active organization
- Fix incorrect 'Failed to update organization' message to 'Failed to delete organization'
- Update comment to be more precise about the check being performed
Fixes#92792
* Improve error handling in organization deletion service
- Add contextual error message when dashboard deletion fails during org deletion
- Include organization ID in error message for better debugging
- Import fmt package for error formatting
This helps administrators understand which specific organization failed
during the deletion process when dashboard cleanup encounters issues.
* Fix typo in unified resource access error message
Change 'Namespace missmatch' to 'Namespace mismatch' for correct spelling.
* fix: increase login_attempt.ip_address column length for IPv6 support
- Expand ip_address column from VARCHAR(30) to VARCHAR(50) to accommodate IPv6 addresses
- Add database migration with support for PostgreSQL, MySQL, and SQLite
- Add comprehensive integration tests for various IPv6 address formats
- Resolves 500 errors when login fails over IPv6, now returns proper 401 errors
Fixes#106362
* test: add missing test skip to TestIntegrationIPv6AddressSupport
Skip integration test when running with -short flag to separate unit and integration tests
* Update pkg/services/sqlstore/migrations/login_attempt_mig.go
Co-authored-by: Victor Cinaglia <victor@grafana.com>
* fix missing bracket
* fix: resolve PostgreSQL timestamp overflow in IPv6 test
- Use controlled time mock instead of time.Now() to avoid timestamp conversion issues
- Follow existing test patterns with xormStore and mock time functions
- Add proper Since parameter to GetIPLoginAttemptCount query
- Fixes PostgreSQL error: 'pq: value "-62135596800" is out of range for type integer'
* fix: resolve PostgreSQL UTF-8 encoding error in IPv6 test
Replace string(rune(i)) with fmt.Sprintf to avoid null bytes (0x00)
when i=0, which caused 'invalid byte sequence for encoding UTF8' error
---------
Co-authored-by: Victor Cinaglia <victor@grafana.com>
* add user ID API translation
* add uid to user frontend
* use users' UIDs in admin pages
* fix ldapSync page
* use global user search for user by UID
* remove active org filtering
* remove orgID params
* add warning on UUIDs not being available before 10.2.0
* Update docs/sources/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/index.md
Co-authored-by: Jack Baldry <jack.baldry@grafana.com>
* Update docs/sources/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/index.md
---------
Co-authored-by: Jack Baldry <jack.baldry@grafana.com>
* reenable ext-jwt-client
* fixup settings struct
* add user and service auth
* lint up
* add user auth to grafana ext
* fixes
* Populate token permissions
Co-authored-by: jguer <joao.guerreiro@grafana.com>
* fix tests
* fix lint
* small prealloc
* small prealloc
* use special namespace for access policies
* fix access policy auth
* fix tests
* fix uncalled settings expander
* add feature toggle
* small feedback fixes
* rename entitlements to permissions
* add authlibn
* allow viewing the signed in user info for non user namespace
* fix invalid namespacedID
* use authlib as verifier for tokens
* Update pkg/services/authn/clients/ext_jwt.go
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
* Update pkg/services/authn/clients/ext_jwt_test.go
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
* fix parameter names
* change asserts to normal package
* add rule for assert
* fix ownerships
* Local diff
* test and lint
* Fix test
* Fix ac test
* Fix pluginproxy test
* Revert testdata changes
* Force revert on test data
---------
Co-authored-by: gamab <gabriel.mabille@grafana.com>
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
* separate context and threads for usage stats
* use constants
* ignore original context
* fix runMetricsFunc
* fix collector registration
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
* change background ctx
* fix test randomness
* Add traces to support bundle collector
* Remove unecessay span
* Add trace to usagestats api
* Close spans
* Mv trace to bundle
* Change span name
* use parent context
* fix runtime declare of stats
* Fix pointer dereference problem on usage stat func
Co-authored-by: Karl Persson <kalle.persson@grafana.com>
Co-authored-by: jguer <joao.guerreiro@grafana.com>
* fix broken support bundle tests by tracer
---------
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
Co-authored-by: gamab <gabriel.mabille@grafana.com>
Co-authored-by: Karl Persson <kalle.persson@grafana.com>
* fix LDAP users authenticated via auth proxy not being able to use ldap sync
* simplify id resolution at the cost of no fallthrough
* remove unused services
* remove unused cache key
* merge JSON search logic
* document public methods
* improve test coverage
* use separate JWT setting struct
* correct use of cfg.JWTAuth
* add group tests
* fix DynMap typing
* add settings to default ini
* add groups option to devenv path
* fix test
* lint
* revert jwt-proxy change
* remove redundant check
* fix parallel test
* Anonymous: Add device limiter
* break auth if limit reached
* fix typo
* refactored const to make it clearer with expiration
* anon device limit for config
---------
Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com>
* remove use of SignedInUserCopies
* add extra safety to not cross assign permissions
unwind circular dependency
dashboardacl->dashboardaccess
fix missing import
* correctly set teams for permissions
* fix missing inits
* nit: check err
* exit early for api keys
fetch fresh permissions for global in AuthorizeInOrgMiddleware
Update pkg/services/accesscontrol/authorize_in_org_test.go
do not load viewer permissions in global ID
Jo
