public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[v10.0.x] Auth: Update docs on use PKCE by default (#69269)

Browse Source 
Auth: Update docs on use PKCE by default (#68638)

* Auth: Update docs on use PKCE by default. (#68073)

Signed-off-by: junya koyama <arukiidou@yahoo.co.jp>

* Fix: docs review - from introduces to provides https://github.com/grafana/grafana/pull/68638/files#r1200506006

Signed-off-by: junya koyama <arukiidou@yahoo.co.jp>

* Fix docs - Remove note about a version https://github.com/grafana/grafana/pull/68638/files#r1200508038

Signed-off-by: junya koyama <arukiidou@yahoo.co.jp>

* Update docs/sources/setup-grafana/configure-security/configure-authentication/azuread/index.md

---------

Signed-off-by: junya koyama <arukiidou@yahoo.co.jp>
Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>
(cherry picked from commit 345b7fadc9)

Co-authored-by: arukiidou <arukiidou@yahoo.co.jp>
This commit is contained in:
Grot (@grafanabot)
2023-05-30 11:49:49 -05:00
committed by GitHub
co-authored by arukiidou
parent 2b95f85f29
commit ae50b74046
5 changed files with 87 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/sources/setup-grafana/configure-security/configure-authentication/gitlab/index.md
+33
View File
@@ -61,6 +61,11 @@ allowed_groups =
role_attribute_path =
role_attribute_strict = false
allow_assign_grafana_admin = false
tls_skip_verify_insecure = false
tls_client_cert =
tls_client_key =
tls_client_ca =
use_pkce = true
```
You may have to set the `root_url` option of `[server]` for the callback URL to be
@@ -81,6 +86,14 @@ to login on your Grafana instance.
You can limit access to only members of a given group or list of
groups by setting the `allowed_groups` option.
You can also specify the SSL/TLS configuration used by the client.
- Set `tls_client_cert` to the path of the certificate.
- Set `tls_client_key` to the path containing the key.
- Set `tls_client_ca` to the path containing a trusted certificate authority list.
`tls_skip_verify_insecure` controls whether a client verifies the server's certificate chain and host name. If it is true, then SSL/TLS accepts any certificate presented by the server and any host name in that certificate. _You should only use this for testing_, because this mode leaves SSL/TLS susceptible to man-in-the-middle attacks.
### Configure refresh token
> Available in Grafana v9.3 and later versions.
@@ -140,8 +153,28 @@ allowed_groups = example, foo/bar
role_attribute_path = is_admin && 'Admin' || 'Viewer'
role_attribute_strict = true
allow_assign_grafana_admin = false
tls_skip_verify_insecure = false
tls_client_cert =
tls_client_key =
tls_client_ca =
use_pkce = true
```
### PKCE
IETF's [RFC 7636](https://datatracker.ietf.org/doc/html/rfc7636)
introduces "proof key for code exchange" (PKCE) which provides
additional protection against some forms of authorization code
interception attacks. PKCE will be required in [OAuth 2.1](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-03).
> You can disable PKCE in Grafana by setting `use_pkce` to `false` in the`[auth.gitlab]` section.
```
use_pkce = true
```
Grafana always uses the SHA256 based `S256` challenge method and a 128 bytes (base64url encoded) code verifier.
### Configure automatic login
Set `auto_login` option to true to attempt login automatically, skipping the login screen.