ef245874da
* extract errors to errors file * implement oauth server admin assignment * add server admin tests * deduplicate autoAssignOrgRole * deduplicate strict setting * deduplicate strict setting * add support for generic oauth * add role attribute strict support for generic oauth * add support for github/gitlab * assignGrafanaAdmin option is here to stay * unify similar errors * add config option * add okta server admin mapping * remove never used Company attribute * unify generic oauth role extract with other methods * case insensitive role match as in azure * add ini settings * add server admin to devenv * remove duplicate fields * add documentation to oauth * fix titlecase test * implement doc feedback
4.0 KiB
| aliases | description | title | weight | ||
|---|---|---|---|---|---|
|
Grafana Okta OAuth Guide | Configure Okta OAuth2 authentication | 1200 |
Configure Okta OAuth2 authentication
Only available in Grafana v7.0+
The Okta authentication allows your Grafana users to log in by using an external Okta authorization server.
Create an Okta application
Before you can sign a user in, you need to create an Okta application from the Okta Developer Console.
-
Log in to the Okta portal.
-
Go to Admin and then select Developer Console.
-
Select Applications, then Add Application.
-
Pick Web as the platform.
-
Enter a name for your application (or leave the default value).
-
Add the Base URI of your application, such as https://grafana.example.com.
-
Enter values for the Login redirect URI. Use Base URI and append it with
/login/okta, for example: https://grafana.example.com/login/okta. -
Click Done to finish creating the Okta application.
Enable Okta OAuth in Grafana
- Add the following to the [Grafana configuration file]({{< relref "../../configure-grafana/#config-file-locations" >}}):
[auth.okta]
name = Okta
icon = okta
enabled = true
allow_sign_up = true
client_id = some_id
client_secret = some_secret
scopes = openid profile email groups
auth_url = https://<tenant-id>.okta.com/oauth2/v1/authorize
token_url = https://<tenant-id>.okta.com/oauth2/v1/token
api_url = https://<tenant-id>.okta.com/oauth2/v1/userinfo
allowed_domains =
allowed_groups =
role_attribute_path =
Configure allowed groups and domains
To limit access to authenticated users that are members of one or more groups, set allowed_groups
to a comma- or space-separated list of Okta groups.
allowed_groups = Developers, Admins
The allowed_domains option limits access to the users belonging to the specific domains. Domains should be separated by space or comma.
allowed_domains = mycompany.com mycompany.org
Map roles
Grafana can attempt to do role mapping through Okta OAuth. In order to achieve this, Grafana checks for the presence of a role using the JMESPath specified via the role_attribute_path configuration option.
Grafana uses JSON obtained from querying the /userinfo endpoint for the path lookup. The result after evaluating the role_attribute_path JMESPath expression needs to be a valid Grafana role, i.e. Viewer, Editor or Admin. For more information about roles and permissions in Grafana, refer to [Roles and permissions]({{< relref "../../../administration/roles-and-permissions/" >}}).
Read about how to add custom claims to the user info in Okta. Also, check Generic OAuth page for [JMESPath examples]({{< relref "generic-oauth/#jmespath-examples" >}}).
Map server administrator privileges
Available in Grafana v9.2 and later versions.
If the application role received by Grafana is GrafanaAdmin, Grafana grants the user server administrator privileges.
This is useful if you want to grant server administrator privileges to a subset of users.
Grafana also assigns the user the Admin role of the default organization.
The setting allow_assign_grafana_admin under [auth.okta] must be set to true for this to work.
If the setting is set to false, the user is assigned the role of Admin of the default organization, but not server administrator privileges.
allow_assign_grafana_admin = true
Example:
role_attribute_path = contains(groups[*], 'admin') && 'GrafanaAdmin' || contains(groups[*], 'editor') && 'Editor' || 'Viewer'
Team Sync (Enterprise only)
Map your Okta groups to teams in Grafana so that your users will automatically be added to the correct teams.
Okta groups can be referenced by group name, like Admins.
[Learn more about Team Sync]({{< relref "../configure-team-sync/" >}})