public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[v10.0.x] Add and document option for enabling email lookup (#914)

Browse Source 
Add and document option for enabling email lookup (#913)

* Docs: Document option for enabling email lookup

* Add the new config in the config files

* Apply suggestions from code review

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>

* Don't capitalize identity providers

* Apply suggestions from code review

Co-authored-by: Jo <joao.guerreiro@grafana.com>

* Apply suggestions from code review

Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>

---------

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
Co-authored-by: Jo <joao.guerreiro@grafana.com>
Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>
(cherry picked from commit 8380bc7d6a79794cc260bf1c427e2b4e849adbf6)

Co-authored-by: Vardan Torosyan <vardants@gmail.com>
This commit is contained in:
Grot (@grafanabot)
2023-06-23 09:01:03 +02:00
committed by Horst Gutmann
co-authored by Vardan Torosyan
parent c179225efe
commit 10415ed301
4 changed files with 55 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/sources/breaking-changes/breaking-changes-v10-0.md
+32
View File
@@ -158,6 +158,38 @@ We've built a [CLI tool](https://grafana.com/blog/2022/12/12/guide-to-using-the-
- [Blog post describing usage of the new CLI command](https://grafana.com/blog/2022/12/12/guide-to-using-the-new-grafana-cli-user-identity-conflict-tool-in-grafana-9.3/)
### Grafana OAuth integrations do not work anymore with email lookups
#### You are affected if:
- You have configured Grafana to use multiple identity providers, and you have users with the same email address in multiple identity providers.
- You have configured Grafana to use Generic OAuth with an identity provider that does not support a unique ID field.
#### Background
Grafana used to validate identity provider accounts based on the email claim. On many identity providers, the email field is not unique, and this could open a possible account vector to perform an account takeover and authentication bypass in certain scenarios.
This change also ensures that Grafana is protected against the [CVE-2023-3128](https://grafana.com/security/security-advisories/CVE-2023-3128) vulnerability.
#### Change in Grafana v10
Grafana will not allow the affected users to sign in.
#### Migration path
In order to address any errors, we have provided an escape hatch that allows you to activate email lookup. You can use the following configuration in your Grafana instance to return the previous behavior.
```
[auth]
oauth_allow_insecure_email_lookup = true
```
We strongly recommend not doing this in case you are using Azure AD as an identity provider with a multi-tenant app.
#### Learn more
- [CVE-2023-3128 Advisory](https://grafana.com/security/security-advisories/CVE-2023-3128)
- [Enable email lookup]({{< relref "../setup-grafana/configure-security/configure-authentication/" >}})
### The "Alias" field in the CloudWatch data source is removed
#### You are affected if: