public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[v9.5.x] Add and document option for enabling email lookup (#915)

Browse Source 
Add and document option for enabling email lookup (#913)

* Docs: Document option for enabling email lookup

* Add the new config in the config files

* Apply suggestions from code review

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>

* Don't capitalize identity providers

* Apply suggestions from code review

Co-authored-by: Jo <joao.guerreiro@grafana.com>

* Apply suggestions from code review

Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>

---------

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
Co-authored-by: Jo <joao.guerreiro@grafana.com>
Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>
(cherry picked from commit 8380bc7d6a79794cc260bf1c427e2b4e849adbf6)
This commit is contained in:
Vardan Torosyan
2023-06-23 08:59:36 +02:00
committed by Horst Gutmann
parent bef41a5cc9
commit 614079fcd9
3 changed files with 23 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/sources/setup-grafana/configure-security/configure-authentication/_index.md
+17
View File
@@ -70,6 +70,9 @@ token_rotation_interval_minutes = 10
# The maximum lifetime (seconds) an API key can be used. If it is set all the API keys should have limited lifetime that is lower than this value.
api_key_max_seconds_to_live = -1
# Enforce user lookup based on email instead of the unique ID provided by the IdP.
oauth_allow_insecure_email_lookup = false
```
### Anonymous authentication
@@ -112,6 +115,20 @@ Hide the Grafana login form using the below configuration settings.
disable_login_form = true
```
### Enable email lookup
Enable user lookup based on email in addition to using unique ID provided by IdPs.
By default, Grafana relies on the user unique ID provided by the identity provider.
Looking up users by email can be safe for some identity providers (for example, when they are single tenants and unique non-editable, validated emails are provided), as well as in some infrastructures.
We strongly recommend against enabling email lookups, however it is possible to do with the following configuration.
```bash
[auth]
oauth_allow_insecure_email_lookup = true
```
### Automatic OAuth login
Set to true to attempt login with specific OAuth provider automatically, skipping the login screen.