public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Auth: Add Generic oauth skip org role sync setting (#62418)

Browse Source 
* add: generic oauth skip org role sync

* add: docs

* add: backend login skip sync

* fix: docs typo

* add: tests

* remove public key

* fix markdown for generic oauth

* add: generic oauth to the configuration

* refactor: change debug to warn
This commit is contained in:
Eric Leijonmarck
2023-02-01 16:27:53 +00:00
committed by GitHub
parent 6b6b733229
commit 8ff19bd901
12 changed files with 107 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/sources/setup-grafana/configure-grafana/_index.md
+16 -1
View File
@@ -936,10 +936,25 @@ The following table shows the OAuth provider's setting with the default value an
| OAuth Provider | `oauth_skip_org_role_sync_update` | `skip_org_role_sync` | Behavior |
| --- | --- | --- | --- |
| GitLab | false | false | User organization roles are set with `defaultRole` and cannot be changed |
| Github | true | false | User organization roles are set with `defaultRole` for GitLab, and Grafana Admins are set. For other providers, the synchronization is skipped, and the org role can be changed, along with other OAuth provider users' org roles. |
| GitLab | true | false | User organization roles are set with `defaultRole` for GitLab, and Grafana Admins are set. For other providers, the synchronization is skipped, and the org role can be changed, along with other OAuth provider users' org roles. |
| GitLab | false | true | User organization roles are set with `defaultRole`, and the organization role can be changed for GitLab synced users. |
| GitLab | true | true | User organization roles are set with `defaultRole` for GitLab. For other providers, the synchronization is skipped, and the org role can be changed, along with other OAuth provider users' org roles. |
### [auth.generic_oauth] skip_org_role_sync
When a user logs in the first time, Grafana sets the organization role based on the value specified in `AutoAssignOrgRole`. If you want to manage organization roles, set the `skip_org_role_sync` option to `true`. the OAuth provider syncs organization roles and sets Grafana Admins.
This also impacts `allow_assign_grafana_admin` setting, by not syncing the grafana admin role from the OAuth provider.
> **Note:** There is a separate setting called `oauth_skip_org_role_update_sync` which has a different scope. While `skip_org_role_sync` only applies to the specific OAuth provider, `oauth_skip_org_role_update_sync` is a generic setting that affects all configured OAuth providers.
The following table shows the OAuth provider's setting with the default value and the skip org role sync setting.
| OAuth Provider | `oauth_skip_org_role_sync_update` | `skip_org_role_sync` | Behavior |
| --- | --- | --- | --- |
| Generic OAuth | false | false | User organization roles are set with `defaultRole` and cannot be changed |
| Generic OAuth | true | false | User organization roles are set with `defaultRole` for Generic OAuth, and Grafana Admins are set. For other providers, the synchronization is skipped, and the org role can be changed, along with other OAuth provider users' org roles. |
| Generic OAuth | false | true | User organization roles are set with `defaultRole`, and the organization role can be changed for Generic OAuth synced users. |
| Generic OAuth | true | true | User organization roles are set with `defaultRole` for Generic OAuth. For other providers, the synchronization is skipped, and the org role can be changed, along with other OAuth provider users' org roles. |
### [auth.okta] skip_org_role_sync
When a user logs in the first time, Grafana sets the organization role based on the value specified in `AutoAssignOrgRole`. If you want to manage organization roles through Grafana's UI, set the `skip_org_role_sync` option to `true`.
docs/sources/setup-grafana/configure-security/configure-authentication/generic-oauth/index.md
+14 -1
View File
@@ -217,7 +217,7 @@ By default, a refresh token is included in the response for the **Authorization
allow_sign_up = true
auto_login = false
client_id = <OpenID Connect Client ID from Centrify>
client_secret = <your generated OpenID Connect Client Secret"
client_secret = <your generated OpenID Connect Client Secret>
scopes = openid profile email
auth_url = https://<your domain>.my.centrify.com/OAuth2/Authorize/<Application ID>
token_url = https://<your domain>.my.centrify.com/OAuth2/Token/<Application ID>
@@ -392,3 +392,16 @@ Payload:
...
}
```
## Skip organization role sync
To prevent the sync of organization roles from the OAuth provider, set `skip_org_role_sync` to `true`. This is useful if you want to manage the organization roles for your users from within Grafana.
This also impacts the `allow_assign_grafana_admin` setting by not syncing the Grafana admin role from the OAuth provider.
```ini
[auth.generic_oauth]
# ..
# prevents the sync of org roles from the Oauth provider
skip_org_role_sync = true
``
```