public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MSSQL: Add Windows AD/Kerberos auth (#84742)

Browse Source 
* mssql: Add Kerberos/Windows AD auth

* need username for cache file

* account for no port in cc file

* add tests around constring

* remove un-needed port

* add docs

* remove comments

* move defer to same locale as where it begins

* fix linting and spelling

* fix gosec linter

* note lack of grafana cloud support
This commit is contained in:
Adam Simpson
2024-03-20 16:41:57 +02:00
committed by GitHub
parent 04c9f459ec
commit 311aa94fab
10 changed files with 571 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/sources/datasources/mssql/_index.md
+13 -1
View File
@@ -52,7 +52,7 @@ To configure basic settings for the data source, complete the following steps:
| **Default** | Sets the data source that's pre-selected for new panels. |
| **Host** | Sets the IP address/hostname and optional port of your MS SQL instance. Default port is 0, the driver default. You can specify multiple connection properties, such as `ApplicationIntent`, by separating each property with a semicolon (`;`). |
| **Database** | Sets the name of your MS SQL database. |
| **Authentication** | Sets the authentication mode, either using SQL Server Authentication or Windows Authentication (single sign-on for Windows users). |
| **Authentication** | Sets the authentication mode, either using SQL Server authentication, Windows authentication (single sign-on for Windows users), Azure Active Directory authentication, or various forms of Windows Active Directory authentication. |
| **User** | Defines the database user's username. |
| **Password** | Defines the database user's password. |
| **Encrypt** | Determines whether or to which extent a secure SSL TCP/IP connection will be negotiated with the server. Options include: `disable` - data sent between client and server is not encrypted; `false` - data sent between client and server is not encrypted beyond the login packet; `true` - data sent between client and server is encrypted. Default is `false`. |
@@ -89,6 +89,18 @@ You can also override this setting in a dashboard panel under its data source op
The **Connection timeout** setting defines the maximum number of seconds to wait for a connection to the database before timing out. Default is 0 for no timeout.
### UDP Preference Limit
The **UDP Preference Limit** setting defines the maximum size packet that the Kerberos libraries will attempt to send over a UDP connection before retrying with TCP. Default is 1 which means always use TCP.
### DNS Lookup KDC
The **DNS Lookup KDC** setting controls whether to [lookup KDC in DNS](https://web.mit.edu/kerberos/krb5-latest/doc/admin/realm_config.html#mapping-hostnames-onto-kerberos-realms). Default is true.
### KRB5 config file path
The **KRB5 config file path** stores the location of the `krb5` config file. Default is `/etc/krb5.conf`
### Database user permissions
Grafana doesn't validate that a query is safe, and could include any SQL statement.
docs/sources/getting-started/get-started-grafana-ms-sql-server.md
+45 -3
View File
@@ -28,18 +28,60 @@ If you are on a Windows host but want to use Grafana and MS SQL data source on a
#### Add the MS SQL data source
There are several ways to authenticate in MSSQL. Start by:
1. Click **Connections** in the left-side menu and filter by `mssql`.
1. Select the **Microsoft SQL Server** option.
1. Click **Create a Microsoft SQL Server data source** in the top right corner to open the configuration page.
1. Enter the information specified in the table below, then click **Save & test**.
1. Select the desired authentication method and fill in the right information as detailed below.
1. Click **Save & test**.
##### General configuration
| Name | Description |
| ---------- | --------------------------------------------------------------------------------------------------------------------- |
| `Name` | The data source name. This is how you refer to the data source in panels and queries. |
| `Host` | The IP address/hostname and optional port of your MS SQL instance. If port is omitted, the default 1433 will be used. |
| `Database` | Name of your MS SQL database. |
| `User` | Database user's login/username. |
| `Password` | Database user's password. |
##### SQL Server Authentication
| Name | Description |
| ---------- | ------------------------------- |
| `User` | Database user's login/username. |
| `Password` | Database user's password. |
##### Windows Active Directory (Kerberos)
Below are the four possible ways to authenticate via Windows Active Directory/Kerberos.
{{< admonition type="note" >}}
Windows Active Directory (Kerberos) authentication is not supported in Grafana Cloud at the moment.
{{< /admonition >}}
| Method | Description |
| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Username + password** | Enter the domain user and password |
| **Keytab file** | Specify the path to a valid keytab file to use that for authentication. |
| **Credential cache** | Log in on the host via `kinit` and pass the path to the credential cache. The cache path can be found by running `klist` on the host in question. |
| **Credential cache file** | This option allows multiple valid configurations to be present and matching is performed on host, database, and user. See the example JSON below this table. |
```json
[
{
"user": "grot@GF.LAB",
"database": "dbone",
"address": "mysql1.mydomain.com:3306",
"credentialCache": "/tmp/krb5cc_1000"
},
{
"user": "grot@GF.LAB",
"database": "dbtwo",
"address": "mysql2.gf.lab",
"credentialCache": "/tmp/krb5cc_1000"
}
]
```
For installations from the [grafana/grafana](https://github.com/grafana/grafana/tree/main) repository, `gdev-mssql` data source is available. Once you add this data source, you can use the `Datasource tests - MSSQL` dashboard with three panels showing metrics generated from a test database.