public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Chore: Query oauth info from a new instance (#83229)

Browse Source 
* query OAuth info from a new instance

* add `hd` validation flag

* add `disable_hd_validation` to settings map

* update documentation

---------

Co-authored-by: Jo <joao.guerreiro@grafana.com>
This commit is contained in:
linoman
2024-02-29 16:48:32 +01:00
committed by GitHub
co-authored by Jo
parent 2a1d4f85c7
commit b02ae375ba
7 changed files with 54 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/sources/setup-grafana/configure-security/configure-authentication/google/index.md
+8
View File
@@ -111,6 +111,14 @@ automatically signed up.
You may specify a domain to be passed as `hd` query parameter accepted by Google's
OAuth 2.0 authentication API. Refer to Google's OAuth [documentation](https://developers.google.com/identity/openid-connect/openid-connect#hd-param).
{{% admonition type="note" %}}
Since Grafana 10.3.0, the `hd` parameter retrieved from Google ID token is also used to determine the user's hosted domain. The Google Oauth `allowed_domains` configuration option is used to restrict access to users from a specific domain. If the `allowed_domains` configuration option is set, the `hd` parameter from the Google ID token must match the `allowed_domains` configuration option. If the `hd` parameter from the Google ID token does not match the `allowed_domains` configuration option, the user is denied access.
When an account does not belong to a google workspace, the hd claim will not be available.
This validation is enabled by default. To disable this validation, set the `validate_hd` configuration option to `false`. The `allowed_domains` configuration option will use the email claim to validate the domain.
{{% /admonition %}}
#### PKCE
IETF's [RFC 7636](https://datatracker.ietf.org/doc/html/rfc7636)