From 6b0d7537287107c4ca95da79f34bac6f5e26ebea Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Eivind=20Gussi=C3=A5s=20L=C3=B8kseth?= Date: Mon, 6 Jul 2020 23:28:31 +0200 Subject: [PATCH] Docs: Fix list of sample providers (#26067) * Fix list of sample providers The sample providers on this page has changed, so the list at the top of the page is no longer correct. Also link to Octo and Azure AD pages from here, since they are also OAuth2 providers. * Fix misspelled Okta * Make bullet list of OAuth2 providers * Sort list of OAuth2 providers alphabetically --- docs/sources/auth/generic-oauth.md | 123 +++++++++++++++-------------- 1 file changed, 64 insertions(+), 59 deletions(-) diff --git a/docs/sources/auth/generic-oauth.md b/docs/sources/auth/generic-oauth.md index d1ce499cfab..80daf75b70f 100755 --- a/docs/sources/auth/generic-oauth.md +++ b/docs/sources/auth/generic-oauth.md @@ -12,8 +12,13 @@ weight = 3 # Generic OAuth Authentication -You can configure many different OAuth2 authentication services with Grafana using the generic OAuth2 feature. Below you -can find examples using Okta, BitBucket, OneLogin and Azure. +You can configure many different OAuth2 authentication services with Grafana using the generic OAuth2 feature. Examples: +- [Auth0](#set-up-oauth2-with-auth0) +- [Azure AD]({{< relref "azuread.md" >}}) +- [BitBucket](#set-up-oauth2-with-bitbucket) +- [Centrify](#set-up-oauth2-with-centrify) +- [Okta]({{< relref "okta.md" >}}) +- [OneLogin](#set-up-oauth2-with-onelogin) This callback URL must match the full HTTP address that you use in your browser to access Grafana, but with the prefix path of `/login/generic_oauth`. @@ -54,6 +59,32 @@ Check for the presence of a role using the [JMESPath](http://jmespath.org/exampl See [JMESPath examples](#jmespath-examples) for more information. +## Set up OAuth2 with Auth0 + +1. Create a new Client in Auth0 + - Name: Grafana + - Type: Regular Web Application + +2. Go to the Settings tab and set: + - Allowed Callback URLs: `https:///login/generic_oauth` + +3. Click Save Changes, then use the values at the top of the page to configure Grafana: + + ```bash + [auth.generic_oauth] + enabled = true + allow_sign_up = true + team_ids = + allowed_organizations = + name = Auth0 + client_id = + client_secret = + scopes = openid profile email + auth_url = https:///authorize + token_url = https:///oauth/token + api_url = https:///userinfo + ``` + ## Set up OAuth2 with Bitbucket ```bash @@ -71,6 +102,37 @@ team_ids = allowed_organizations = ``` +## Set up OAuth2 with Centrify + +1. Create a new Custom OpenID Connect application configuration in the Centrify dashboard. + +2. Create a memorable unique Application ID, e.g. "grafana", "grafana_aws", etc. + +3. Put in other basic configuration (name, description, logo, category) + +4. On the Trust tab, generate a long password and put it into the OpenID Connect Client Secret field. + +5. Put the URL to the front page of your Grafana instance into the "Resource Application URL" field. + +6. Add an authorized Redirect URI like https://your-grafana-server/login/generic_oauth + +7. Set up permissions, policies, etc. just like any other Centrify app + +8. Configure Grafana as follows: + + ```bash + [auth.generic_oauth] + name = Centrify + enabled = true + allow_sign_up = true + client_id = + client_secret = .my.centrify.com/OAuth2/Authorize/ + token_url = https://.my.centrify.com/OAuth2/Token/ + api_url = https://.my.centrify.com/OAuth2/UserInfo/ + ``` + ## Set up OAuth2 with OneLogin 1. Create a new Custom Connector with the following settings: @@ -106,63 +168,6 @@ allowed_organizations = allowed_organizations = ``` -## Set up OAuth2 with Auth0 - -1. Create a new Client in Auth0 - - Name: Grafana - - Type: Regular Web Application - -2. Go to the Settings tab and set: - - Allowed Callback URLs: `https:///login/generic_oauth` - -3. Click Save Changes, then use the values at the top of the page to configure Grafana: - - ```bash - [auth.generic_oauth] - enabled = true - allow_sign_up = true - team_ids = - allowed_organizations = - name = Auth0 - client_id = - client_secret = - scopes = openid profile email - auth_url = https:///authorize - token_url = https:///oauth/token - api_url = https:///userinfo - ``` - -## Set up OAuth2 with Centrify - -1. Create a new Custom OpenID Connect application configuration in the Centrify dashboard. - -2. Create a memorable unique Application ID, e.g. "grafana", "grafana_aws", etc. - -3. Put in other basic configuration (name, description, logo, category) - -4. On the Trust tab, generate a long password and put it into the OpenID Connect Client Secret field. - -5. Put the URL to the front page of your Grafana instance into the "Resource Application URL" field. - -6. Add an authorized Redirect URI like https://your-grafana-server/login/generic_oauth - -7. Set up permissions, policies, etc. just like any other Centrify app - -8. Configure Grafana as follows: - - ```bash - [auth.generic_oauth] - name = Centrify - enabled = true - allow_sign_up = true - client_id = - client_secret = .my.centrify.com/OAuth2/Authorize/ - token_url = https://.my.centrify.com/OAuth2/Token/ - api_url = https://.my.centrify.com/OAuth2/UserInfo/ - ``` - ## JMESPath examples To ease configuration of a proper JMESPath expression, you can test/evaluate expressions with custom payloads at http://jmespath.org/.