public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

SCIM: Add IDP specific SAML configuration (#106327)

Browse Source 
* Add assertion_attrbiute_external_uid definition

* Add Okta specific configuration

* Add Azure AD configuration

* Expand definition and reference idp specific configuration
This commit is contained in:
linoman
2025-06-05 10:50:28 +02:00
committed by GitHub
parent 1c2bec7bd7
commit 9717d04039
5 changed files with 43 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/sources/setup-grafana/configure-grafana/enterprise-configuration/index.md
+4
View File
@@ -308,6 +308,10 @@ Friendly name or name of the attribute within the SAML assertion to use as the u
Friendly name or name of the attribute within the SAML assertion to use as the user organization.
### assertion_attribute_external_uid
Friendly name or name of the attribute within the SAML assertion to use as the user external UID.
### allowed_organizations
List of comma- or space-separated organizations. Each user must be a member of at least one organization to log in.
docs/sources/setup-grafana/configure-security/configure-authentication/saml/configure-saml-with-azuread/_index.md
+14
View File
@@ -80,6 +80,20 @@ In order to validate Entra ID users with Grafana, you need to configure the SAML
1. Select **Add**.
1. Copy the value of the secret. This value is used in the `client_secret` field in the [SAML configuration](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/setup-grafana/configure-security/configure-authentication/saml/saml-configuration-options/).
## Configure SAML assertions when using SCIM provisioning
In order to verify the logged in user is the same user that was provisioned through Azure AD, you need to include the same `externalId` in the SAML assertion by mapping the SAML assertion `assertion_attribute_external_id`.
1. Open your Entra ID application.
1. Select the SAML single sign-on configuration.
1. Edit the `Attributes & Claims` section.
1. Add a new claim with the following settings:
- Name: `userUID`
- Namespace: leave blank
- Source: Attribute
- Source attribute: `user.objectId`
1. **Save** the current configuration.
## Configure a Graph API application in Entra ID
While an Entra ID tenant can be configured in Grafana via SAML, some additional information is only accessible via the Graph API. To retrieve this information, create a new application in Entra ID and grant it the necessary permissions.
docs/sources/setup-grafana/configure-security/configure-authentication/saml/configure-saml-with-okta/_index.md
+17 -1
View File
@@ -35,7 +35,7 @@ Grafana supports user authentication through Okta, which is useful when you want
{{< admonition type="note" >}}
If you plan to enable SAML Single Logout, consider setting the **Name ID format** to `EmailAddress` or `Persistent`. This must match the `name_id_format` setting of the Grafana instance.
{{< /admonition >}}
- In the **ATTRIBUTE STATEMENTS (OPTIONAL)** section, enter the SAML attributes to be shared with Grafana. The attribute names in Okta need to match exactly what is defined within Grafana, for example:
- In the **ATTRIBUTE STATEMENTS (REQUIRED)** section, enter the SAML attributes to be shared with Grafana. The attribute names in Okta need to match exactly what is defined within Grafana, for example:
| Attribute name (in Grafana) | Name and value (in Okta profile) | Grafana configuration (under `auth.saml`) |
| --------------------------- | ---------------------------------------------------- | ----------------------------------------- |
@@ -47,3 +47,19 @@ Grafana supports user authentication through Okta, which is useful when you want
1. Click **Next**.
1. On the final Feedback tab, fill out the form and then click **Finish**.
## Configure SAML assertions when using SCIM provisioning
In order to verify the logged in user is the same user that was provisioned through Okta, you need to include the same `externalId` in the SAML assertion by mapping the SAML assertion `assertion_attribute_external_id`.
1. Open your Okta application.
1. Select the SAML single sign-on configuration.
1. Edit the `Attributes & Claims` section.
1. Add a new claim with the following settings:
- Name: `userUID`
### Example configuration
| Attribute name (in Grafana) | Name and value (in Okta profile) | Grafana default configuration (under `auth.saml`) |
| --------------------------- | ------------------------------------------ | ------------------------------------------------- |
| userUID | userUID - `user.getInternalProperty("id")` | `assertion_attribute_login = userUID` |
docs/sources/setup-grafana/configure-security/configure-authentication/saml/saml-configuration-options/_index.md
+1
View File
@@ -36,6 +36,7 @@ The table below describes all SAML configuration options. Continue reading below
| `assertion_attribute_groups` | No | Friendly name or name of the attribute within the SAML assertion to use as the user groups. | |
| `assertion_attribute_role` | No | Friendly name or name of the attribute within the SAML assertion to use as the user roles. | |
| `assertion_attribute_org` | No | Friendly name or name of the attribute within the SAML assertion to use as the user organization | |
| `assertion_attribute_external_uid` | No | Friendly name or name of the attribute within the SAML assertion to use as the user external UID. | `userUID` |
| `allowed_organizations` | No | List of comma- or space-separated organizations. User should be a member of at least one organization to log in. | |
| `org_mapping` | No | List of comma- or space-separated Organization:OrgId:Role mappings. Organization can be `*` meaning "All users". Role is optional and can have the following values: `None`, `Viewer`, `Editor` or `Admin`. | |
| `role_values_none` | No | List of comma- or space-separated roles which will be mapped into the None role. | |
docs/sources/setup-grafana/configure-security/configure-scim-provisioning/_index.md
+7 -3
View File
@@ -60,15 +60,19 @@ SCIM offers several advantages for managing users and teams in Grafana:
When you enable SCIM in Grafana, the following requirements and restrictions apply:
1. **Use the same identity provider**: You must use the same identity provider for both authentication and user provisioning. For example, if you use Azure AD for SCIM, you must also use Azure AD for authentication.
1. **Use the same identity provider for user provisioning and for authentication flow**: You must use the same identity provider for both authentication and user provisioning.
2. **Authentication restrictions**:
- Users attempting to log in through other methods (LDAP, OAuth) will be blocked
- By default, users who are not provisioned through SCIM cannot access Grafana
- You can allow non-SCIM users by setting `allow_non_provisioned_users = true`
3. **Exceptions**: Users with Basic Auth credentials and those using their Grafana Cloud accounts can still log in regardless of these restrictions.
3. **Security restriction**: When using SAML, the login authentication flow requires the SAML assertion exchange between the Identity Provider and Grafana to include the `userUID` SAML assertion with the user's unique identifier at the Identity Provider.
- Configure `userUID` SAML assertion in [Azure AD](/docs/grafana/<GRAFANA_VERSION>/setup-grafana/configure-security/configure-authentication/saml/configure-saml-with-azuread/#configure-saml-assertions-when-using-scim-provisioning)
- Configure `userUID` SAML assertion in [Okta](/docs/grafana/<GRAFANA_VERSION>/setup-grafana/configure-security/configure-authentication/saml/configure-saml-with-okta/#configure-saml-assertions-when-using-scim-provisioning)
4. **Exceptions**: Users with Basic Auth credentials and those using their Grafana Cloud accounts can still log in regardless of these restrictions.
## Configure SCIM in Grafana