From 7eb4b974e0407a126af0a5a1b2b538dd9611d30e Mon Sep 17 00:00:00 2001 From: Vardan Torosyan Date: Tue, 12 Nov 2024 09:44:49 +0100 Subject: [PATCH] Docs: Better explanation for enabling lookup and a small fix on okta role mapping (#96232) * Docs: Better explanation for enabling lookup and a small fix on okta role mapping * Run prettier --- .../configure-authentication/_index.md | 11 +++++++---- .../configure-authentication/okta/index.md | 2 +- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/docs/sources/setup-grafana/configure-security/configure-authentication/_index.md b/docs/sources/setup-grafana/configure-security/configure-authentication/_index.md index 3f208f23fd2..56c8eac59f9 100644 --- a/docs/sources/setup-grafana/configure-security/configure-authentication/_index.md +++ b/docs/sources/setup-grafana/configure-security/configure-authentication/_index.md @@ -177,12 +177,15 @@ disable_login_form = true ### Enable email lookup -Enable user lookup based on email in addition to using unique ID provided by IdPs. +By default, Grafana identifies users based on the unique ID provided by the identity provider (IdP). +In certain cases, however, enabling user lookups by email can be a feasible option, such as when: -By default, Grafana relies on the user unique ID provided by the identity provider. -Looking up users by email can be safe for some identity providers (for example, when they are single tenants and unique non-editable, validated emails are provided), as well as in some infrastructures. +- The identity provider is a single-tenant setup. +- Unique, validated, and non-editable emails are provided by the IdP. +- The infrastructure allows email-based identification without compromising security. -We strongly recommend against enabling email lookups, however it is possible to do with the following configuration. +**Important note**: While it is possible to configure Grafana to allow email-based user lookups, we strongly recommend against this approach in most cases due to potential security risks. +If you still choose to proceed, the following configuration can be applied to enable email lookup. ```bash [auth] diff --git a/docs/sources/setup-grafana/configure-security/configure-authentication/okta/index.md b/docs/sources/setup-grafana/configure-security/configure-authentication/okta/index.md index 7f12a747c31..09ad9c98fb6 100644 --- a/docs/sources/setup-grafana/configure-security/configure-authentication/okta/index.md +++ b/docs/sources/setup-grafana/configure-security/configure-authentication/okta/index.md @@ -49,7 +49,7 @@ To follow this guide, ensure you have permissions in your Okta workspace to crea - **API URL** For example: https://.okta.com/oauth2/v1/userinfo -### Configure Okta to Grafana Cloud role mapping +### Configure Okta to Grafana role mapping 1. In the **Okta Admin Console**, select **Directory > Profile Editor**. 1. Select the Okta Application Profile you created previously (the default name for this is ` User`).