diff --git a/docs/sources/auth/generic-oauth.md b/docs/sources/auth/generic-oauth.md index d1ce499cfab..80daf75b70f 100755 --- a/docs/sources/auth/generic-oauth.md +++ b/docs/sources/auth/generic-oauth.md @@ -12,8 +12,13 @@ weight = 3 # Generic OAuth Authentication -You can configure many different OAuth2 authentication services with Grafana using the generic OAuth2 feature. Below you -can find examples using Okta, BitBucket, OneLogin and Azure. +You can configure many different OAuth2 authentication services with Grafana using the generic OAuth2 feature. Examples: +- [Auth0](#set-up-oauth2-with-auth0) +- [Azure AD]({{< relref "azuread.md" >}}) +- [BitBucket](#set-up-oauth2-with-bitbucket) +- [Centrify](#set-up-oauth2-with-centrify) +- [Okta]({{< relref "okta.md" >}}) +- [OneLogin](#set-up-oauth2-with-onelogin) This callback URL must match the full HTTP address that you use in your browser to access Grafana, but with the prefix path of `/login/generic_oauth`. @@ -54,6 +59,32 @@ Check for the presence of a role using the [JMESPath](http://jmespath.org/exampl See [JMESPath examples](#jmespath-examples) for more information. +## Set up OAuth2 with Auth0 + +1. Create a new Client in Auth0 + - Name: Grafana + - Type: Regular Web Application + +2. Go to the Settings tab and set: + - Allowed Callback URLs: `https:///login/generic_oauth` + +3. Click Save Changes, then use the values at the top of the page to configure Grafana: + + ```bash + [auth.generic_oauth] + enabled = true + allow_sign_up = true + team_ids = + allowed_organizations = + name = Auth0 + client_id = + client_secret = + scopes = openid profile email + auth_url = https:///authorize + token_url = https:///oauth/token + api_url = https:///userinfo + ``` + ## Set up OAuth2 with Bitbucket ```bash @@ -71,6 +102,37 @@ team_ids = allowed_organizations = ``` +## Set up OAuth2 with Centrify + +1. Create a new Custom OpenID Connect application configuration in the Centrify dashboard. + +2. Create a memorable unique Application ID, e.g. "grafana", "grafana_aws", etc. + +3. Put in other basic configuration (name, description, logo, category) + +4. On the Trust tab, generate a long password and put it into the OpenID Connect Client Secret field. + +5. Put the URL to the front page of your Grafana instance into the "Resource Application URL" field. + +6. Add an authorized Redirect URI like https://your-grafana-server/login/generic_oauth + +7. Set up permissions, policies, etc. just like any other Centrify app + +8. Configure Grafana as follows: + + ```bash + [auth.generic_oauth] + name = Centrify + enabled = true + allow_sign_up = true + client_id = + client_secret = .my.centrify.com/OAuth2/Authorize/ + token_url = https://.my.centrify.com/OAuth2/Token/ + api_url = https://.my.centrify.com/OAuth2/UserInfo/ + ``` + ## Set up OAuth2 with OneLogin 1. Create a new Custom Connector with the following settings: @@ -106,63 +168,6 @@ allowed_organizations = allowed_organizations = ``` -## Set up OAuth2 with Auth0 - -1. Create a new Client in Auth0 - - Name: Grafana - - Type: Regular Web Application - -2. Go to the Settings tab and set: - - Allowed Callback URLs: `https:///login/generic_oauth` - -3. Click Save Changes, then use the values at the top of the page to configure Grafana: - - ```bash - [auth.generic_oauth] - enabled = true - allow_sign_up = true - team_ids = - allowed_organizations = - name = Auth0 - client_id = - client_secret = - scopes = openid profile email - auth_url = https:///authorize - token_url = https:///oauth/token - api_url = https:///userinfo - ``` - -## Set up OAuth2 with Centrify - -1. Create a new Custom OpenID Connect application configuration in the Centrify dashboard. - -2. Create a memorable unique Application ID, e.g. "grafana", "grafana_aws", etc. - -3. Put in other basic configuration (name, description, logo, category) - -4. On the Trust tab, generate a long password and put it into the OpenID Connect Client Secret field. - -5. Put the URL to the front page of your Grafana instance into the "Resource Application URL" field. - -6. Add an authorized Redirect URI like https://your-grafana-server/login/generic_oauth - -7. Set up permissions, policies, etc. just like any other Centrify app - -8. Configure Grafana as follows: - - ```bash - [auth.generic_oauth] - name = Centrify - enabled = true - allow_sign_up = true - client_id = - client_secret = .my.centrify.com/OAuth2/Authorize/ - token_url = https://.my.centrify.com/OAuth2/Token/ - api_url = https://.my.centrify.com/OAuth2/UserInfo/ - ``` - ## JMESPath examples To ease configuration of a proper JMESPath expression, you can test/evaluate expressions with custom payloads at http://jmespath.org/.