diff --git a/docs/sources/setup-grafana/configure-grafana/enterprise-configuration/index.md b/docs/sources/setup-grafana/configure-grafana/enterprise-configuration/index.md index bf4b6fc65c6..e5be11382e0 100644 --- a/docs/sources/setup-grafana/configure-grafana/enterprise-configuration/index.md +++ b/docs/sources/setup-grafana/configure-grafana/enterprise-configuration/index.md @@ -308,6 +308,10 @@ Friendly name or name of the attribute within the SAML assertion to use as the u Friendly name or name of the attribute within the SAML assertion to use as the user organization. +### assertion_attribute_external_uid + +Friendly name or name of the attribute within the SAML assertion to use as the user external UID. + ### allowed_organizations List of comma- or space-separated organizations. Each user must be a member of at least one organization to log in. diff --git a/docs/sources/setup-grafana/configure-security/configure-authentication/saml/configure-saml-with-azuread/_index.md b/docs/sources/setup-grafana/configure-security/configure-authentication/saml/configure-saml-with-azuread/_index.md index bad2752eb3c..97942f0341a 100644 --- a/docs/sources/setup-grafana/configure-security/configure-authentication/saml/configure-saml-with-azuread/_index.md +++ b/docs/sources/setup-grafana/configure-security/configure-authentication/saml/configure-saml-with-azuread/_index.md @@ -80,6 +80,20 @@ In order to validate Entra ID users with Grafana, you need to configure the SAML 1. Select **Add**. 1. Copy the value of the secret. This value is used in the `client_secret` field in the [SAML configuration](https://grafana.com/docs/grafana//setup-grafana/configure-security/configure-authentication/saml/saml-configuration-options/). +## Configure SAML assertions when using SCIM provisioning + +In order to verify the logged in user is the same user that was provisioned through Azure AD, you need to include the same `externalId` in the SAML assertion by mapping the SAML assertion `assertion_attribute_external_id`. + +1. Open your Entra ID application. +1. Select the SAML single sign-on configuration. +1. Edit the `Attributes & Claims` section. +1. Add a new claim with the following settings: + - Name: `userUID` + - Namespace: leave blank + - Source: Attribute + - Source attribute: `user.objectId` +1. **Save** the current configuration. + ## Configure a Graph API application in Entra ID While an Entra ID tenant can be configured in Grafana via SAML, some additional information is only accessible via the Graph API. To retrieve this information, create a new application in Entra ID and grant it the necessary permissions. diff --git a/docs/sources/setup-grafana/configure-security/configure-authentication/saml/configure-saml-with-okta/_index.md b/docs/sources/setup-grafana/configure-security/configure-authentication/saml/configure-saml-with-okta/_index.md index c79ed3e6353..123a1298385 100644 --- a/docs/sources/setup-grafana/configure-security/configure-authentication/saml/configure-saml-with-okta/_index.md +++ b/docs/sources/setup-grafana/configure-security/configure-authentication/saml/configure-saml-with-okta/_index.md @@ -35,7 +35,7 @@ Grafana supports user authentication through Okta, which is useful when you want {{< admonition type="note" >}} If you plan to enable SAML Single Logout, consider setting the **Name ID format** to `EmailAddress` or `Persistent`. This must match the `name_id_format` setting of the Grafana instance. {{< /admonition >}} - - In the **ATTRIBUTE STATEMENTS (OPTIONAL)** section, enter the SAML attributes to be shared with Grafana. The attribute names in Okta need to match exactly what is defined within Grafana, for example: + - In the **ATTRIBUTE STATEMENTS (REQUIRED)** section, enter the SAML attributes to be shared with Grafana. The attribute names in Okta need to match exactly what is defined within Grafana, for example: | Attribute name (in Grafana) | Name and value (in Okta profile) | Grafana configuration (under `auth.saml`) | | --------------------------- | ---------------------------------------------------- | ----------------------------------------- | @@ -47,3 +47,19 @@ Grafana supports user authentication through Okta, which is useful when you want 1. Click **Next**. 1. On the final Feedback tab, fill out the form and then click **Finish**. + +## Configure SAML assertions when using SCIM provisioning + +In order to verify the logged in user is the same user that was provisioned through Okta, you need to include the same `externalId` in the SAML assertion by mapping the SAML assertion `assertion_attribute_external_id`. + +1. Open your Okta application. +1. Select the SAML single sign-on configuration. +1. Edit the `Attributes & Claims` section. +1. Add a new claim with the following settings: + - Name: `userUID` + +### Example configuration + +| Attribute name (in Grafana) | Name and value (in Okta profile) | Grafana default configuration (under `auth.saml`) | +| --------------------------- | ------------------------------------------ | ------------------------------------------------- | +| userUID | userUID - `user.getInternalProperty("id")` | `assertion_attribute_login = userUID` | diff --git a/docs/sources/setup-grafana/configure-security/configure-authentication/saml/saml-configuration-options/_index.md b/docs/sources/setup-grafana/configure-security/configure-authentication/saml/saml-configuration-options/_index.md index 561aa0d6bf0..ec60b9ce2f2 100644 --- a/docs/sources/setup-grafana/configure-security/configure-authentication/saml/saml-configuration-options/_index.md +++ b/docs/sources/setup-grafana/configure-security/configure-authentication/saml/saml-configuration-options/_index.md @@ -36,6 +36,7 @@ The table below describes all SAML configuration options. Continue reading below | `assertion_attribute_groups` | No | Friendly name or name of the attribute within the SAML assertion to use as the user groups. | | | `assertion_attribute_role` | No | Friendly name or name of the attribute within the SAML assertion to use as the user roles. | | | `assertion_attribute_org` | No | Friendly name or name of the attribute within the SAML assertion to use as the user organization | | +| `assertion_attribute_external_uid` | No | Friendly name or name of the attribute within the SAML assertion to use as the user external UID. | `userUID` | | `allowed_organizations` | No | List of comma- or space-separated organizations. User should be a member of at least one organization to log in. | | | `org_mapping` | No | List of comma- or space-separated Organization:OrgId:Role mappings. Organization can be `*` meaning "All users". Role is optional and can have the following values: `None`, `Viewer`, `Editor` or `Admin`. | | | `role_values_none` | No | List of comma- or space-separated roles which will be mapped into the None role. | | diff --git a/docs/sources/setup-grafana/configure-security/configure-scim-provisioning/_index.md b/docs/sources/setup-grafana/configure-security/configure-scim-provisioning/_index.md index 99deb0331b5..4d9a5dab53c 100644 --- a/docs/sources/setup-grafana/configure-security/configure-scim-provisioning/_index.md +++ b/docs/sources/setup-grafana/configure-security/configure-scim-provisioning/_index.md @@ -60,15 +60,19 @@ SCIM offers several advantages for managing users and teams in Grafana: When you enable SCIM in Grafana, the following requirements and restrictions apply: -1. **Use the same identity provider**: You must use the same identity provider for both authentication and user provisioning. For example, if you use Azure AD for SCIM, you must also use Azure AD for authentication. +1. **Use the same identity provider for user provisioning and for authentication flow**: You must use the same identity provider for both authentication and user provisioning. 2. **Authentication restrictions**: - Users attempting to log in through other methods (LDAP, OAuth) will be blocked - By default, users who are not provisioned through SCIM cannot access Grafana - - You can allow non-SCIM users by setting `allow_non_provisioned_users = true` -3. **Exceptions**: Users with Basic Auth credentials and those using their Grafana Cloud accounts can still log in regardless of these restrictions. +3. **Security restriction**: When using SAML, the login authentication flow requires the SAML assertion exchange between the Identity Provider and Grafana to include the `userUID` SAML assertion with the user's unique identifier at the Identity Provider. + + - Configure `userUID` SAML assertion in [Azure AD](/docs/grafana//setup-grafana/configure-security/configure-authentication/saml/configure-saml-with-azuread/#configure-saml-assertions-when-using-scim-provisioning) + - Configure `userUID` SAML assertion in [Okta](/docs/grafana//setup-grafana/configure-security/configure-authentication/saml/configure-saml-with-okta/#configure-saml-assertions-when-using-scim-provisioning) + +4. **Exceptions**: Users with Basic Auth credentials and those using their Grafana Cloud accounts can still log in regardless of these restrictions. ## Configure SCIM in Grafana