Auth: Add skip_org_role_sync setting for GrafanaCom (#60553)
* add frontend settings and setting for grafanacom * removed println * add skip-org-role-sync on login * add deprecation notice for this field * remove println * remove newline * change and renamed variables * fix for reconfiguring the settings for grafanacom * add documentationf or grafanacom setup * WIP tests * added tests * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * updated steps * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * doc: updated the docs to reflect what happens to grafana.com users * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Jo <joao.guerreiro@grafana.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Jo <joao.guerreiro@grafana.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Jo <joao.guerreiro@grafana.com> * add blankline * rephrase of doc improvements for explaing of the settings * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Jo <joao.guerreiro@grafana.com> * add frontend setting for grafanacom. * WIP tests * refactor docs * frontend to adhere to skipping org role sync for GrafanaCom users * update docs to reflect desired behavior * tests: added test for skip and nonskip * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> Co-authored-by: Jo <joao.guerreiro@grafana.com> Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
This commit is contained in:
Eric Leijonmarck
co-authored by
Christopher Moyer
Jo
Ieva
Christopher Moyer
Jo
Ieva
parent
e7b8b82c14
commit
91322bebb5
@@ -849,6 +849,8 @@ Administrators can increase this if they experience OAuth login state mismatch e
|
||||
|
||||
### oauth_skip_org_role_update_sync
|
||||
|
||||
> **Note**: This option will soon be a legacy option in favor of OAuth provider specific `skip_org_role_sync` settings.
|
||||
|
||||
Skip forced assignment of OrgID `1` or `auto_assign_org_id` for external logins. Default is `false`.
|
||||
Use this setting to allow users with external login to be manually assigned to multiple organizations.
|
||||
|
||||
@@ -858,6 +860,20 @@ By default, the users' organization and role is reset on every new login.
|
||||
> With Grafana 10, if `oauth_skip_org_role_update_sync` option is set to `false`, users with no mapping will be
|
||||
> reset to the default organization role on every login. [See `auto_assign_org_role` option]({{< relref ".#auto_assign_org_role" >}}).
|
||||
|
||||
### [auth.grafana_com] skip_org_role_update_sync
|
||||
|
||||
To prevent synchronization of organization roles for a specific OAuth integration, you can set the `skip_org_role_sync` option to `true`. Please note that there is also a separate setting called `oauth_skip_org_role_update_sync` which has a different scope. While `skip_org_role_sync` only applies to the specific OAuth provider, `oauth_skip_org_role_update_sync` is a generic setting that affects all configured OAuth providers.
|
||||
|
||||
The setting `oauth_skip_org_role_update_sync` will be deprecated in favor of provider-specific settings.
|
||||
|
||||
The table below shows the available OAuth providers and their setting with the default value and the skip org role sync setting.
|
||||
| OAuth Provider | `oauth_skip_org_role_sync_update` | `skip_org_role_sync` | Behavior |
|
||||
| --- | --- | --- | --- |
|
||||
| Grafana.com | false | false | will sync with Grafana.com roles |
|
||||
| Grafana.com | true | false | skip org role sync for OAuth providers including Grafana.com users |
|
||||
| Grafana.com | false | true | skip org role sync for grafana.com users |
|
||||
| Grafana.com | true | true | skip org role sync for Grafana.com users and all other OAuth providers |
|
||||
|
||||
### api_key_max_seconds_to_live
|
||||
|
||||
Limit of API key seconds to live before expiration. Default is -1 (unlimited).
|
||||
|
||||
+46
@@ -0,0 +1,46 @@
|
||||
---
|
||||
aliases:
|
||||
- ../../../auth/grafana-com/
|
||||
description: Grafana Com Authentication
|
||||
title: Configure Grafana Com authentication
|
||||
weight: 500
|
||||
---
|
||||
|
||||
# Configure Grafana Com authentication
|
||||
|
||||
To enable GrafanaCom as your authentication provider, you configure it to generate a client ID and a secret key.
|
||||
|
||||
## Create GrafanaCom OAuth keys
|
||||
|
||||
To use GrafanaCom authentication:
|
||||
|
||||
1. Log in to [GrafanaCom](https://grafana.com).
|
||||
1. To create an OAuth client, locate your organization and click **OAuth Clients**.
|
||||
1. Click **Add OAuth Client Application**.
|
||||
1. Add the name and URL of your running Grafana instance.
|
||||
1. Click **Add OAuth Client**.
|
||||
1. Copy the client ID and secret key or the configuration that has been generated.
|
||||
|
||||
The following snippet shows an example configuration:
|
||||
|
||||
```ini
|
||||
[auth.grafana_com]
|
||||
enabled = true
|
||||
allow_sign_up = true
|
||||
client_id = 450bc21c10dc2194879d
|
||||
client_secret = eyJ0Ijoib2F1dGgyYyIhlmlkIjoiNzUwYmMzM2MxMGRjMjE6NDh3OWQiLCJ2IjoiZmI1YzVlYmIwYzFmN2ZhYzZmNjIwOGI1NmVkYTRlNWYxMzgwM2NkMiJ9
|
||||
scopes = user:email
|
||||
allowed_organizations = sampleorganization
|
||||
enabled = true
|
||||
```
|
||||
|
||||
## Skip organization role sync
|
||||
|
||||
To prevent the sync of org roles from Grafana.com, set `skip_org_role_sync` to `true`. This is useful if you want to manage the organization roles for your users from within Grafana.
|
||||
|
||||
```ini
|
||||
[auth.grafana_com]
|
||||
# ..
|
||||
# prevents the sync of org roles from Grafana.com
|
||||
skip_org_role_sync = true
|
||||
```
|
||||
Reference in New Issue
Block a user