From 52deb821d68ecbf0393baf622e7fffb311df6ef9 Mon Sep 17 00:00:00 2001 From: Eric Leijonmarck Date: Thu, 9 Jun 2022 10:11:12 +0200 Subject: [PATCH] Docs: fix authsaml to security (#50478) Co-authored-by: Emil Tullstedt --- .../configure-security/configure-authentication/saml.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/sources/setup-grafana/configure-security/configure-authentication/saml.md b/docs/sources/setup-grafana/configure-security/configure-authentication/saml.md index cce17545126..85f33f00d74 100644 --- a/docs/sources/setup-grafana/configure-security/configure-authentication/saml.md +++ b/docs/sources/setup-grafana/configure-security/configure-authentication/saml.md @@ -410,7 +410,7 @@ The keys you provide should look like: ### SAML login attempts fail with request response "origin not allowed" -When the user logs in using SAML and gets presented with "origin not allowed", the user might be issuing the login from an IdP (identity provider) service or the user is behind a reverse proxy. This potentially happens as Grafana's CSRF checks deem the requests to be invalid. For more information [CSRF](https://en.wikipedia.org/wiki/Cross-site_request_forgery). +When the user logs in using SAML and gets presented with "origin not allowed", the user might be issuing the login from an IdP (identity provider) service or the user is behind a reverse proxy. This potentially happens as Grafana's CSRF checks deem the requests to be invalid. For more information [CSRF](https://owasp.org/www-community/attacks/csrf). To solve this issue, you can configure either the [`csrf_trusted_origins`]({{< relref "../../configure-grafana/enterprise-configuration/#csrf-trusted-origins" >}}) or [`csrf_origin_headers`]({{< relref "../../configure-grafana/enterprise-configuration/#csrf-origin-headers" >}}) option in the SAML configuration. @@ -419,7 +419,7 @@ Example of a configuration file: ```bash # config.ini ... -[auth.saml] +[security] csrf_trusted_origins = https://grafana.example.com csrf_origin_headers = X-Forwarded-Proto X-Forwarded-Host X-Forwarded-Port ...