public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[v9.4.x] Add and document option for enabling email lookup (#916)

Browse Source 
Add and document option for enabling email lookup (#913)

* Docs: Document option for enabling email lookup

* Add the new config in the config files

* Apply suggestions from code review

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>

* Don't capitalize identity providers

* Apply suggestions from code review

Co-authored-by: Jo <joao.guerreiro@grafana.com>

* Apply suggestions from code review

Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>

---------

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
Co-authored-by: Jo <joao.guerreiro@grafana.com>
Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>
(cherry picked from commit 8380bc7d6a79794cc260bf1c427e2b4e849adbf6)
This commit is contained in:
Vardan Torosyan
2023-06-23 08:58:43 +02:00
committed by Horst Gutmann
parent 5829fdd399
commit 1a333623cf
3 changed files with 23 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
conf/defaults.ini
+3
View File
@@ -504,6 +504,9 @@ sigv4_verbose_logging = false
# Set to true to enable Azure authentication option for HTTP-based datasources
azure_auth_enabled = false
# Use email lookup in addition to the unique ID provided by the IdP
oauth_allow_insecure_email_lookup = false
#################################### Anonymous Auth ######################
[auth.anonymous]
# enable anonymous access
conf/sample.ini
+3
View File
@@ -508,6 +508,9 @@
# Set to skip the organization role from JWT login and use system's role assignment instead.
; skip_org_role_sync = false
# Use email lookup in addition to the unique ID provided by the IdP
;oauth_allow_insecure_email_lookup = false
#################################### Anonymous Auth ######################
[auth.anonymous]
# enable anonymous access
docs/sources/setup-grafana/configure-security/configure-authentication/_index.md
+17
View File
@@ -78,6 +78,9 @@ token_rotation_interval_minutes = 10
# The maximum lifetime (seconds) an API key can be used. If it is set all the API keys should have limited lifetime that is lower than this value.
api_key_max_seconds_to_live = -1
# Enforce user lookup based on email instead of the unique ID provided by the IdP.
oauth_allow_insecure_email_lookup = false
```
### Anonymous authentication
@@ -120,6 +123,20 @@ You can hide the Grafana login form using the below configuration settings.
disable_login_form = true
```
### Enable email lookup
Enable user lookup based on email in addition to using unique ID provided by IdPs.
By default, Grafana relies on the user unique ID provided by the identity provider.
Looking up users by email can be safe for some identity providers (for example, when they are single tenants and unique non-editable, validated emails are provided), as well as in some infrastructures.
We strongly recommend against enabling email lookups, however it is possible to do with the following configuration.
```bash
[auth]
oauth_allow_insecure_email_lookup = true
```
### Automatic OAuth login
Set to true to attempt login with specific OAuth provider automatically, skipping the login screen.