PackageJson: Prettify markdown/mdx on commit with lint-staged (#37616)
* Format md,mdx files with prettier on lint-staged * Manually run prettier on docs/sources
This commit is contained in:
Connor Lindsey
@@ -9,7 +9,7 @@ weight = 100
|
||||
|
||||
> **Note:** Fine-grained access control is in beta, and you can expect changes in future releases.
|
||||
|
||||
Fine-grained access control provides a standardized way of granting, changing, and revoking access when it comes to viewing and modifying Grafana resources, such as users and reports.
|
||||
Fine-grained access control provides a standardized way of granting, changing, and revoking access when it comes to viewing and modifying Grafana resources, such as users and reports.
|
||||
Fine-grained access control works alongside the current [Grafana permissions]({{< relref "../../permissions/_index.md" >}}), and it allows you granular control of users’ actions.
|
||||
|
||||
To learn more about how fine-grained access control works, refer to [Roles]({{< relref "./roles.md" >}}) and [Permissions]({{< relref "./permissions.md" >}}).
|
||||
|
||||
@@ -6,31 +6,32 @@ weight = 130
|
||||
+++
|
||||
|
||||
# Fine-grained access control references
|
||||
|
||||
The reference information that follows complements conceptual information about [Roles]({{< relref "./roles.md" >}}).
|
||||
|
||||
## Fine-grained access fixed roles
|
||||
|
||||
Fixed roles | Permissions | Descriptions
|
||||
--- | --- | ---
|
||||
`fixed:permissions:admin:read` | `roles:read`<br>`roles:list`<br>`roles.builtin:list` | Allows to list and get available roles and built-in role assignments.
|
||||
`fixed:permissions:admin:edit` | All permissions from `fixed:permissions:admin:read` and <br>`roles:write`<br>`roles:delete`<br>`roles.builtin:add`<br>`roles.builtin:remove` | Allows every read action and in addition allows to create, change and delete custom roles and create or remove built-in role assignments.
|
||||
`fixed:reporting:admin:read` | `reports:read`<br>`reports:send`<br>`reports.settings:read` | Allows to read reports and report settings.
|
||||
`fixed:reporting:admin:edit` | All permissions from `fixed:reporting:admin:read` and <br>`reports.admin:write`<br>`reports:delete`<br>`reports.settings:write` | Allows every read action for reports and in addition allows to administer reports.
|
||||
`fixed:users:admin:read` | `users.authtoken:list`<br>`users.quotas:list`<br>`users:read`<br>`users.teams:read` | Allows to list and get users and related information.
|
||||
`fixed:users:admin:edit` | All permissions from `fixed:users:admin:read` and <br>`users.password:update`<br>`users:write`<br>`users:create`<br>`users:delete`<br>`users:enable`<br>`users:disable`<br>`users.permissions:update`<br>`users:logout`<br>`users.authtoken:update`<br>`users.quotas:update` | Allows every read action for users and in addition allows to administer users.
|
||||
`fixed:users:org:read` | `org.users:read` | Allows to get user organizations.
|
||||
`fixed:users:org:edit` | All permissions from `fixed:users:org:read` and <br>`org.users:add`<br>`org.users:remove`<br>`org.users.role:update` | Allows every read action for user organizations and in addition allows to administer user organizations.
|
||||
`fixed:ldap:admin:read` | `ldap.user:read`<br>`ldap.status:read` | Allows to read LDAP information and status.
|
||||
`fixed:ldap:admin:edit` | All permissions from `fixed:ldap:admin:read` and <br>`ldap.user:sync`<br>`ldap.config:reload` | Allows every read action for LDAP and in addition allows to administer LDAP.
|
||||
`fixed:server:admin:read` | `server.stats:read` | Read server stats
|
||||
`fixed:settings:admin:read` | `settings:read` | Read settings
|
||||
`fixed:settings:admin:edit` | All permissions from `fixed:settings:admin:read` and<br>`settings:write` | Update settings
|
||||
`fixed:datasource:editor:read` | `datasources:explore` | Explore datasources
|
||||
| Fixed roles | Permissions | Descriptions |
|
||||
| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| `fixed:permissions:admin:read` | `roles:read`<br>`roles:list`<br>`roles.builtin:list` | Allows to list and get available roles and built-in role assignments. |
|
||||
| `fixed:permissions:admin:edit` | All permissions from `fixed:permissions:admin:read` and <br>`roles:write`<br>`roles:delete`<br>`roles.builtin:add`<br>`roles.builtin:remove` | Allows every read action and in addition allows to create, change and delete custom roles and create or remove built-in role assignments. |
|
||||
| `fixed:reporting:admin:read` | `reports:read`<br>`reports:send`<br>`reports.settings:read` | Allows to read reports and report settings. |
|
||||
| `fixed:reporting:admin:edit` | All permissions from `fixed:reporting:admin:read` and <br>`reports.admin:write`<br>`reports:delete`<br>`reports.settings:write` | Allows every read action for reports and in addition allows to administer reports. |
|
||||
| `fixed:users:admin:read` | `users.authtoken:list`<br>`users.quotas:list`<br>`users:read`<br>`users.teams:read` | Allows to list and get users and related information. |
|
||||
| `fixed:users:admin:edit` | All permissions from `fixed:users:admin:read` and <br>`users.password:update`<br>`users:write`<br>`users:create`<br>`users:delete`<br>`users:enable`<br>`users:disable`<br>`users.permissions:update`<br>`users:logout`<br>`users.authtoken:update`<br>`users.quotas:update` | Allows every read action for users and in addition allows to administer users. |
|
||||
| `fixed:users:org:read` | `org.users:read` | Allows to get user organizations. |
|
||||
| `fixed:users:org:edit` | All permissions from `fixed:users:org:read` and <br>`org.users:add`<br>`org.users:remove`<br>`org.users.role:update` | Allows every read action for user organizations and in addition allows to administer user organizations. |
|
||||
| `fixed:ldap:admin:read` | `ldap.user:read`<br>`ldap.status:read` | Allows to read LDAP information and status. |
|
||||
| `fixed:ldap:admin:edit` | All permissions from `fixed:ldap:admin:read` and <br>`ldap.user:sync`<br>`ldap.config:reload` | Allows every read action for LDAP and in addition allows to administer LDAP. |
|
||||
| `fixed:server:admin:read` | `server.stats:read` | Read server stats |
|
||||
| `fixed:settings:admin:read` | `settings:read` | Read settings |
|
||||
| `fixed:settings:admin:edit` | All permissions from `fixed:settings:admin:read` and<br>`settings:write` | Update settings |
|
||||
| `fixed:datasource:editor:read` | `datasources:explore` | Explore datasources |
|
||||
|
||||
## Default built-in role assignments
|
||||
|
||||
Built-in roles | Associated roles | Descriptions
|
||||
--- | --- | ---
|
||||
Grafana Admin | `fixed:permissions:admin:edit`<br>`fixed:permissions:admin:read`<br>`fixed:reporting:admin:edit`<br>`fixed:reporting:admin:read`<br>`fixed:users:admin:edit`<br>`fixed:users:admin:read`<br>`fixed:users:org:edit`<br>`fixed:users:org:read`<br>`fixed:ldap:admin:edit`<br>`fixed:ldap:admin:read`<br>`fixed:server:admin:read`<br>`fixed:settings:admin:read`<br>`fixed:settings:admin:edit` | Allows access to resources which [Grafana Server Admin]({{< relref "../../permissions/_index.md#grafana-server-admin-role" >}}) has permissions by default.
|
||||
Admin | `fixed:users:org:edit`<br>`fixed:users:org:read`<br>`fixed:reporting:admin:edit`<br>`fixed:reporting:admin:read` | Allows access to resource which [Admin]({{< relref "../../permissions/organization_roles.md" >}}) has permissions by default.
|
||||
Editor | `fixed:datasource:editor:read`
|
||||
| Built-in roles | Associated roles | Descriptions |
|
||||
| -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| Grafana Admin | `fixed:permissions:admin:edit`<br>`fixed:permissions:admin:read`<br>`fixed:reporting:admin:edit`<br>`fixed:reporting:admin:read`<br>`fixed:users:admin:edit`<br>`fixed:users:admin:read`<br>`fixed:users:org:edit`<br>`fixed:users:org:read`<br>`fixed:ldap:admin:edit`<br>`fixed:ldap:admin:read`<br>`fixed:server:admin:read`<br>`fixed:settings:admin:read`<br>`fixed:settings:admin:edit` | Allows access to resources which [Grafana Server Admin]({{< relref "../../permissions/_index.md#grafana-server-admin-role" >}}) has permissions by default. |
|
||||
| Admin | `fixed:users:org:edit`<br>`fixed:users:org:read`<br>`fixed:reporting:admin:edit`<br>`fixed:reporting:admin:read` | Allows access to resource which [Admin]({{< relref "../../permissions/organization_roles.md" >}}) has permissions by default. |
|
||||
| Editor | `fixed:datasource:editor:read` |
|
||||
|
||||
@@ -9,7 +9,7 @@ weight = 115
|
||||
|
||||
A permission is an action and a scope. When creating a fine-grained access control, consider what specific action a user should be allowed to perform, and on what resources (its scope).
|
||||
|
||||
To grant permissions to a user, you create a built-in role assignment to map a role to a built-in role. A built-in role assignment *modifies* to one of the existing built-in roles in Grafana (Viewer, Editor, Admin). For more information, refer to [Built-in role assignments]({{< relref "./roles.md#built-in-role-assignments" >}}).
|
||||
To grant permissions to a user, you create a built-in role assignment to map a role to a built-in role. A built-in role assignment _modifies_ to one of the existing built-in roles in Grafana (Viewer, Editor, Admin). For more information, refer to [Built-in role assignments]({{< relref "./roles.md#built-in-role-assignments" >}}).
|
||||
|
||||
To learn more about which permissions are used for which resources, refer to [Resources with fine-grained permissions]({{< relref "./_index.md#resources-with-fine-grained-permissions" >}}).
|
||||
|
||||
@@ -23,61 +23,61 @@ scope
|
||||
|
||||
The following list contains fine-grained access control actions.
|
||||
|
||||
Actions | Applicable scopes | Descriptions
|
||||
--- | --- | ---
|
||||
`roles:list` | `roles:*` | List available roles without permissions.
|
||||
`roles:read` | `roles:*` | Read a specific role with it's permissions.
|
||||
`roles:write` | `permissions:delegate` | Create or update a custom role.
|
||||
`roles:delete` | `permissions:delegate` | Delete a custom role.
|
||||
`roles.builtin:list` | `roles:*` | List built-in role assignments.
|
||||
`roles.builtin:add` | `permissions:delegate` | Create a built-in role assignment.
|
||||
`roles.builtin:remove` | `permissions:delegate` | Delete a built-in role assignment.
|
||||
`reports.admin:create` | `reports:*` | Create reports.
|
||||
`reports.admin:write` | `reports:*` | Update reports.
|
||||
`reports:delete` | `reports:*` | Delete reports.
|
||||
`reports:read` | `reports:*` | List all available reports or get a specific report.
|
||||
`reports:send` | `reports:*` | Send a report email.
|
||||
`reports.settings:write` | n/a | Update report settings.
|
||||
`reports.settings:read` | n/a | Read report settings.
|
||||
`provisioning:reload` | `service:accesscontrol` | Reload provisioning files.
|
||||
`users:read` | `global:users:*` | Read or search user profiles.
|
||||
`users:write` | `global:users:*` | Update a user’s profile.
|
||||
`users.teams:read` | `global:users:*` | Read a user’s teams.
|
||||
`users.authtoken:list` | `global:users:*` | List authentication tokens that are assigned to a user.
|
||||
`users.authtoken:update` | `global:users:*` | Update authentication tokens that are assigned to a user.
|
||||
`users.password:update` | `global:users:*` | Update a user’s password.
|
||||
`users:delete` | `global:users:*` | Delete a user.
|
||||
`users:create` | n/a | Create a user.
|
||||
`users:enable` | `global:users:*` | Enable a user.
|
||||
`users:disable` | `global:users:*` | Disable a user.
|
||||
`users.permissions:update` | `global:users:*` | Update a user’s organization-level permissions.
|
||||
`users:logout` | `global:users:*` | Log out a user.
|
||||
`users.quotas:list` | `global:users:*` | List a user’s quotas.
|
||||
`users.quotas:update` | `global:users:*` | Update a user’s quotas.
|
||||
`org.users.read` | `users:*` | Get user profiles within an organization.
|
||||
`org.users.add` | `users:*` | Add a user to an organization.
|
||||
`org.users.remove` | `users:*` | Remove a user from an organization.
|
||||
`org.users.role:update` | `users:*` | Update the organization role (`Viewer`, `Editor`, `Admin`) for an organization.
|
||||
`ldap.user:read` | n/a | Get a user via LDAP.
|
||||
`ldap.user:sync` | n/a | Sync a user via LDAP.
|
||||
`ldap.status:read` | n/a | Verify the LDAP servers’ availability.
|
||||
`ldap.config:reload` | n/a | Reload the LDAP configuration.
|
||||
`status:accesscontrol` | `service:accesscontrol` | Get access-control enabled status.
|
||||
`settings:read` | `settings:**`<br>`settings:auth.saml:*`<br>`settings:auth.saml:enabled` (property level) | Read settings
|
||||
`settings:write` | `settings:**`<br>`settings:auth.saml:*`<br>`settings:auth.saml:enabled` (property level) | Update settings
|
||||
`server.stats:read` | n/a | Read server stats
|
||||
`datasources:explore` | n/a | Enable explore
|
||||
| Actions | Applicable scopes | Descriptions |
|
||||
| -------------------------- | ---------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------- |
|
||||
| `roles:list` | `roles:*` | List available roles without permissions. |
|
||||
| `roles:read` | `roles:*` | Read a specific role with it's permissions. |
|
||||
| `roles:write` | `permissions:delegate` | Create or update a custom role. |
|
||||
| `roles:delete` | `permissions:delegate` | Delete a custom role. |
|
||||
| `roles.builtin:list` | `roles:*` | List built-in role assignments. |
|
||||
| `roles.builtin:add` | `permissions:delegate` | Create a built-in role assignment. |
|
||||
| `roles.builtin:remove` | `permissions:delegate` | Delete a built-in role assignment. |
|
||||
| `reports.admin:create` | `reports:*` | Create reports. |
|
||||
| `reports.admin:write` | `reports:*` | Update reports. |
|
||||
| `reports:delete` | `reports:*` | Delete reports. |
|
||||
| `reports:read` | `reports:*` | List all available reports or get a specific report. |
|
||||
| `reports:send` | `reports:*` | Send a report email. |
|
||||
| `reports.settings:write` | n/a | Update report settings. |
|
||||
| `reports.settings:read` | n/a | Read report settings. |
|
||||
| `provisioning:reload` | `service:accesscontrol` | Reload provisioning files. |
|
||||
| `users:read` | `global:users:*` | Read or search user profiles. |
|
||||
| `users:write` | `global:users:*` | Update a user’s profile. |
|
||||
| `users.teams:read` | `global:users:*` | Read a user’s teams. |
|
||||
| `users.authtoken:list` | `global:users:*` | List authentication tokens that are assigned to a user. |
|
||||
| `users.authtoken:update` | `global:users:*` | Update authentication tokens that are assigned to a user. |
|
||||
| `users.password:update` | `global:users:*` | Update a user’s password. |
|
||||
| `users:delete` | `global:users:*` | Delete a user. |
|
||||
| `users:create` | n/a | Create a user. |
|
||||
| `users:enable` | `global:users:*` | Enable a user. |
|
||||
| `users:disable` | `global:users:*` | Disable a user. |
|
||||
| `users.permissions:update` | `global:users:*` | Update a user’s organization-level permissions. |
|
||||
| `users:logout` | `global:users:*` | Log out a user. |
|
||||
| `users.quotas:list` | `global:users:*` | List a user’s quotas. |
|
||||
| `users.quotas:update` | `global:users:*` | Update a user’s quotas. |
|
||||
| `org.users.read` | `users:*` | Get user profiles within an organization. |
|
||||
| `org.users.add` | `users:*` | Add a user to an organization. |
|
||||
| `org.users.remove` | `users:*` | Remove a user from an organization. |
|
||||
| `org.users.role:update` | `users:*` | Update the organization role (`Viewer`, `Editor`, `Admin`) for an organization. |
|
||||
| `ldap.user:read` | n/a | Get a user via LDAP. |
|
||||
| `ldap.user:sync` | n/a | Sync a user via LDAP. |
|
||||
| `ldap.status:read` | n/a | Verify the LDAP servers’ availability. |
|
||||
| `ldap.config:reload` | n/a | Reload the LDAP configuration. |
|
||||
| `status:accesscontrol` | `service:accesscontrol` | Get access-control enabled status. |
|
||||
| `settings:read` | `settings:**`<br>`settings:auth.saml:*`<br>`settings:auth.saml:enabled` (property level) | Read settings |
|
||||
| `settings:write` | `settings:**`<br>`settings:auth.saml:*`<br>`settings:auth.saml:enabled` (property level) | Update settings |
|
||||
| `server.stats:read` | n/a | Read server stats |
|
||||
| `datasources:explore` | n/a | Enable explore |
|
||||
|
||||
## Scope definitions
|
||||
|
||||
The following list contains fine-grained access control scopes.
|
||||
|
||||
Scopes | Descriptions
|
||||
--- | ---
|
||||
`roles:*` | Restrict an action to a set of roles. For example, `roles:*` matches any role, `roles:randomuid` matches only the role with UID `randomuid` and `roles:custom:reports:{editor,viewer}` matches both `custom:reports:editor` and `custom:reports:viewer` roles.
|
||||
`permissions:delegate` | The scope is only applicable for roles associated with the Access Control itself and indicates that you can delegate your permissions only, or a subset of it, by creating a new role or making an assignment.
|
||||
`reports:*` | Restrict an action to a set of reports. For example, `reports:*` matches any report and `reports:1` matches the report with id `1`.
|
||||
`service:accesscontrol` | Restrict an action to target only the fine-grained access control service. For example, you can use this in conjunction with the `provisioning:reload` or the `status:accesscontrol` actions.
|
||||
`global:users:*` | Restrict an action to a set of global users.
|
||||
`users:*` | Restrict an action to a set of users from an organization.
|
||||
`settings:**` | Restrict an action to a subset of settings. For example, `settings:**` matches all settings, `settings:auth.saml:*` matches all SAML settings, and `settings:auth.saml:enabled` matches the enable property on the SAML settings.
|
||||
| Scopes | Descriptions |
|
||||
| ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| `roles:*` | Restrict an action to a set of roles. For example, `roles:*` matches any role, `roles:randomuid` matches only the role with UID `randomuid` and `roles:custom:reports:{editor,viewer}` matches both `custom:reports:editor` and `custom:reports:viewer` roles. |
|
||||
| `permissions:delegate` | The scope is only applicable for roles associated with the Access Control itself and indicates that you can delegate your permissions only, or a subset of it, by creating a new role or making an assignment. |
|
||||
| `reports:*` | Restrict an action to a set of reports. For example, `reports:*` matches any report and `reports:1` matches the report with id `1`. |
|
||||
| `service:accesscontrol` | Restrict an action to target only the fine-grained access control service. For example, you can use this in conjunction with the `provisioning:reload` or the `status:accesscontrol` actions. |
|
||||
| `global:users:*` | Restrict an action to a set of global users. |
|
||||
| `users:*` | Restrict an action to a set of users from an organization. |
|
||||
| `settings:**` | Restrict an action to a subset of settings. For example, `settings:**` matches all settings, `settings:auth.saml:*` matches all SAML settings, and `settings:auth.saml:enabled` matches the enable property on the SAML settings. |
|
||||
|
||||
@@ -6,7 +6,7 @@ weight = 120
|
||||
+++
|
||||
|
||||
# Provisioning
|
||||
|
||||
|
||||
You can create, change or remove [Custom roles]({{< relref "./roles.md#custom-roles" >}}) and create or remove [built-in role assignments]({{< relref "./roles.md#built-in-role-assignments" >}}), by adding one or more YAML configuration files in the [`provisioning/access-control/`]({{< relref "../../administration/configuration/#provisioning" >}}) directory.
|
||||
Refer to [Grafana provisioning]({{< relref "../../administration/configuration/#provisioning" >}}) to learn more about provisioning.
|
||||
|
||||
@@ -38,16 +38,16 @@ apiVersion: 1
|
||||
# Roles to insert into the database, or roles to update in the database
|
||||
roles:
|
||||
- name: custom:users:editor
|
||||
description: "This role allows users to list, create, or update other users within the organization."
|
||||
description: 'This role allows users to list, create, or update other users within the organization.'
|
||||
version: 1
|
||||
orgId: 1
|
||||
permissions:
|
||||
- action: "users:read"
|
||||
scope: "users:*"
|
||||
- action: "users:write"
|
||||
scope: "users:*"
|
||||
- action: "users:create"
|
||||
scope: "users:*"
|
||||
- action: 'users:read'
|
||||
scope: 'users:*'
|
||||
- action: 'users:write'
|
||||
scope: 'users:*'
|
||||
- action: 'users:create'
|
||||
scope: 'users:*'
|
||||
```
|
||||
|
||||
Here is an example YAML file to create a global role with a set of permissions, where the `global:true` option makes a role global:
|
||||
@@ -59,26 +59,28 @@ apiVersion: 1
|
||||
# Roles to insert into the database, or roles to update in the database
|
||||
roles:
|
||||
- name: custom:users:editor
|
||||
description: "This role allows users to list, create, or update other users within the organization."
|
||||
description: 'This role allows users to list, create, or update other users within the organization.'
|
||||
version: 1
|
||||
global: true
|
||||
permissions:
|
||||
- action: "users:read"
|
||||
scope: "users:*"
|
||||
- action: "users:write"
|
||||
scope: "users:*"
|
||||
- action: "users:create"
|
||||
scope: "users:*"
|
||||
- action: 'users:read'
|
||||
scope: 'users:*'
|
||||
- action: 'users:write'
|
||||
scope: 'users:*'
|
||||
- action: 'users:create'
|
||||
scope: 'users:*'
|
||||
```
|
||||
|
||||
The `orgId` is lost when the role is set to global.
|
||||
|
||||
### Delete roles
|
||||
### Delete roles
|
||||
|
||||
To delete a role, add a list of roles under the `deleteRoles` section in the configuration file.
|
||||
To delete a role, add a list of roles under the `deleteRoles` section in the configuration file.
|
||||
|
||||
> **Note:** Any role in the `deleteRoles` section is deleted before any role in the `roles` section is saved.
|
||||
|
||||
Here is an example YAML file to delete a role:
|
||||
|
||||
```yaml
|
||||
# config file version
|
||||
apiVersion: 1
|
||||
@@ -105,19 +107,19 @@ apiVersion: 1
|
||||
# Roles to insert/update in the database
|
||||
roles:
|
||||
- name: custom:users:editor
|
||||
description: "This role allows users to list/create/update other users in the organization"
|
||||
description: 'This role allows users to list/create/update other users in the organization'
|
||||
version: 1
|
||||
orgId: 1
|
||||
permissions:
|
||||
- action: "users:read"
|
||||
scope: "users:*"
|
||||
- action: "users:write"
|
||||
scope: "users:*"
|
||||
- action: "users:create"
|
||||
scope: "users:*"
|
||||
- action: 'users:read'
|
||||
scope: 'users:*'
|
||||
- action: 'users:write'
|
||||
scope: 'users:*'
|
||||
- action: 'users:create'
|
||||
scope: 'users:*'
|
||||
builtInRoles:
|
||||
- name: "Editor"
|
||||
- name: "Admin"
|
||||
- name: 'Editor'
|
||||
- name: 'Admin'
|
||||
```
|
||||
|
||||
## Manage default built-in role assignments
|
||||
@@ -129,15 +131,15 @@ During startup, Grafana creates [default built-in role assignments]({{< relref "
|
||||
To remove default built-in role assignments, use the `removeDefaultAssignments` element in the configuration file. You need to provide the built-in role name and fixed role name.
|
||||
|
||||
Here is an example:
|
||||
|
||||
```yaml
|
||||
# config file version
|
||||
apiVersion: 1
|
||||
|
||||
# list of default built-in role assignments that should be removed
|
||||
removeDefaultAssignments:
|
||||
- builtInRole: "Grafana Admin"
|
||||
fixedRole: "fixed:permissions:admin"
|
||||
|
||||
- builtInRole: 'Grafana Admin'
|
||||
fixedRole: 'fixed:permissions:admin'
|
||||
```
|
||||
|
||||
### Restore default assignment
|
||||
@@ -145,14 +147,15 @@ removeDefaultAssignments:
|
||||
To restore the default built-in role assignment, use the `addDefaultAssignments` element in the configuration file. You need to provide the built-in role name and the fixed-role name.
|
||||
|
||||
Here is an example:
|
||||
|
||||
```yaml
|
||||
# config file version
|
||||
apiVersion: 1
|
||||
|
||||
# list of default built-in role assignments that should be added back
|
||||
addDefaultAssignments:
|
||||
- builtInRole: "Admin"
|
||||
fixedRole: "fixed:reporting:admin:read"
|
||||
- builtInRole: 'Admin'
|
||||
fixedRole: 'fixed:reporting:admin:read'
|
||||
```
|
||||
|
||||
## Full example of a role configuration file
|
||||
@@ -164,29 +167,29 @@ apiVersion: 1
|
||||
# list of default built-in role assignments that should be removed
|
||||
removeDefaultAssignments:
|
||||
# <string>, must be one of the Organization roles (`Viewer`, `Editor`, `Admin`) or `Grafana Admin`
|
||||
- builtInRole: "Grafana Admin"
|
||||
- builtInRole: 'Grafana Admin'
|
||||
# <string>, must be one of the existing fixed roles
|
||||
fixedRole: "fixed:permissions:admin"
|
||||
fixedRole: 'fixed:permissions:admin'
|
||||
|
||||
# list of default built-in role assignments that should be added back
|
||||
addDefaultAssignments:
|
||||
# <string>, must be one of the Organization roles (`Viewer`, `Editor`, `Admin`) or `Grafana Admin`
|
||||
- builtInRole: "Admin"
|
||||
- builtInRole: 'Admin'
|
||||
# <string>, must be one of the existing fixed roles
|
||||
fixedRole: "fixed:reporting:admin:read"
|
||||
|
||||
fixedRole: 'fixed:reporting:admin:read'
|
||||
|
||||
# list of roles that should be deleted
|
||||
deleteRoles:
|
||||
# <string> name of the role you want to create. Required if no uid is set
|
||||
- name: "custom:reports:editor"
|
||||
- name: 'custom:reports:editor'
|
||||
# <string> uid of the role. Required if no name
|
||||
uid: "customreportseditor1"
|
||||
uid: 'customreportseditor1'
|
||||
# <int> org id. will default to Grafana's default if not specified
|
||||
orgId: 1
|
||||
# <bool> force deletion revoking all grants of the role
|
||||
force: true
|
||||
- name: "custom:global:reports:reader"
|
||||
uid: "customglobalreportsreader1"
|
||||
- name: 'custom:global:reports:reader'
|
||||
uid: 'customglobalreportsreader1'
|
||||
# <bool> overwrite org id and removes a global role
|
||||
global: true
|
||||
force: true
|
||||
@@ -194,44 +197,44 @@ deleteRoles:
|
||||
# list of roles to insert/update depending on what is available in the database
|
||||
roles:
|
||||
# <string, required> name of the role you want to create. Required
|
||||
- name: "custom:users:editor"
|
||||
- name: 'custom:users:editor'
|
||||
# <string> uid of the role. Has to be unique for all orgs.
|
||||
uid: customuserseditor1
|
||||
# <string> description of the role, informative purpose only.
|
||||
description: "Role for our custom user editors"
|
||||
description: 'Role for our custom user editors'
|
||||
# <int> version of the role, Grafana will update the role when increased
|
||||
version: 2
|
||||
# <int> org id. will default to Grafana's default if not specified
|
||||
orgId: 1
|
||||
orgId: 1
|
||||
# <list> list of the permissions granted by this role
|
||||
permissions:
|
||||
# <string, required> action allowed
|
||||
- action: "users:read"
|
||||
- action: 'users:read'
|
||||
#<string> scope it applies to
|
||||
scope: "users:*"
|
||||
- action: "users:write"
|
||||
scope: "users:*"
|
||||
- action: "users:create"
|
||||
scope: "users:*"
|
||||
scope: 'users:*'
|
||||
- action: 'users:write'
|
||||
scope: 'users:*'
|
||||
- action: 'users:create'
|
||||
scope: 'users:*'
|
||||
# <list> list of builtIn roles the role should be assigned to
|
||||
builtInRoles:
|
||||
# <string, required> name of the builtin role you want to assign the role to
|
||||
- name: "Editor"
|
||||
- name: 'Editor'
|
||||
# <int> org id. will default to the role org id
|
||||
orgId: 1
|
||||
- name: "custom:global:users:reader"
|
||||
uid: "customglobalusersreader1"
|
||||
description: "Global Role for custom user readers"
|
||||
orgId: 1
|
||||
- name: 'custom:global:users:reader'
|
||||
uid: 'customglobalusersreader1'
|
||||
description: 'Global Role for custom user readers'
|
||||
version: 1
|
||||
# <bool> overwrite org id and creates a global role
|
||||
global: true
|
||||
permissions:
|
||||
- action: "users:read"
|
||||
scope: "users:*"
|
||||
- action: 'users:read'
|
||||
scope: 'users:*'
|
||||
builtInRoles:
|
||||
- name: "Viewer"
|
||||
orgId: 1
|
||||
- name: "Editor"
|
||||
- name: 'Viewer'
|
||||
orgId: 1
|
||||
- name: 'Editor'
|
||||
# <bool> overwrite org id and assign role globally
|
||||
global: true
|
||||
```
|
||||
@@ -251,7 +254,7 @@ A basic set of validation rules are applied to the input `yaml` files.
|
||||
### Roles
|
||||
|
||||
- `name` must not be empty
|
||||
- `name` must not have `fixed:` prefix.
|
||||
- `name` must not have `fixed:` prefix.
|
||||
|
||||
### Permissions
|
||||
|
||||
@@ -259,9 +262,9 @@ A basic set of validation rules are applied to the input `yaml` files.
|
||||
|
||||
### Built-in role assignments
|
||||
|
||||
- `name` must be one of the Organization roles (`Viewer`, `Editor`, `Admin`) or `Grafana Admin`.
|
||||
- `name` must be one of the Organization roles (`Viewer`, `Editor`, `Admin`) or `Grafana Admin`.
|
||||
- When `orgId` is not specified, it inherits the `orgId` from `role`. For global roles the default `orgId` is used.
|
||||
- `orgId` in the `role` and in the assignment must be the same for none global roles.
|
||||
- `orgId` in the `role` and in the assignment must be the same for none global roles.
|
||||
|
||||
### Role deletion
|
||||
|
||||
|
||||
@@ -10,6 +10,7 @@ weight = 105
|
||||
A role represents set of permissions that allow you to perform specific actions on Grafana resources. Refer to [Permissions]({{< relref "./permissions.md" >}}) to understand how permissions work.
|
||||
|
||||
There are two types of roles:
|
||||
|
||||
- [Fixed roles]({{< relref "./roles.md#fixed-roles" >}}), which provide granular access for specific resources within Grafana and are managed by the Grafana itself.
|
||||
- [Custom roles]({{< relref "./roles.md#custom-roles.md" >}}), which provide granular access based on the user specified set of permissions.
|
||||
|
||||
@@ -25,7 +26,7 @@ Fixed roles provide convenience and guarantee of consistent behaviour by combini
|
||||
There are few basic rules for fixed roles:
|
||||
|
||||
- All fixed roles are _global_.
|
||||
- All fixed roles have a `fixed:` prefix.
|
||||
- All fixed roles have a `fixed:` prefix.
|
||||
- You can’t change or delete a fixed role.
|
||||
|
||||
For more information, refer to [Fine-grained access control references]({{< relref "./fine-grained-access-control-references.md#fine-grained-access-fixed-roles" >}}).
|
||||
@@ -68,7 +69,7 @@ Note that you won't be able to create, update or delete a custom role with permi
|
||||
|
||||
## Built-in role assignments
|
||||
|
||||
To control what your users can access or not, you can assign or unassign [Custom roles]({{< ref "#custom-roles" >}}) or [Fixed roles]({{< ref "#fixed-roles" >}}) to the existing [Organization roles]({{< relref "../../permissions/organization_roles.md" >}}) or to [Grafana Server Admin]({{< relref "../../permissions/_index.md#grafana-server-admin-role" >}}) role.
|
||||
To control what your users can access or not, you can assign or unassign [Custom roles]({{< ref "#custom-roles" >}}) or [Fixed roles]({{< ref "#fixed-roles" >}}) to the existing [Organization roles]({{< relref "../../permissions/organization_roles.md" >}}) or to [Grafana Server Admin]({{< relref "../../permissions/_index.md#grafana-server-admin-role" >}}) role.
|
||||
These assignments are called built-in role assignments.
|
||||
|
||||
During startup, Grafana will create default assignments for you. When you make any changes to the built-on role assignments, Grafana will take them into account and won’t overwrite during next start.
|
||||
@@ -82,4 +83,4 @@ You can create or remove built-in role assignments using [Fine-grained access co
|
||||
### Scope of assignments
|
||||
|
||||
A built-in role assignment can be either _global_ or _organization local_. _Global_ assignments are not mapped to any specific organization and will be applied to all organizations, whereas _organization local_ assignments are only applied for that specific organization.
|
||||
You can only create _organization local_ assignments for _organization local_ roles.
|
||||
You can only create _organization local_ assignments for _organization local_ roles.
|
||||
|
||||
@@ -13,15 +13,17 @@ Before you get started, make sure to [enable fine-grained access control]({{< re
|
||||
|
||||
## Check all built-in role assignments
|
||||
|
||||
You can use the [Fine-grained access control HTTP API]({{< relref "../../http_api/access_control.md#get-all-built-in-role-assignments" >}}) to see all available built-in role assignments.
|
||||
You can use the [Fine-grained access control HTTP API]({{< relref "../../http_api/access_control.md#get-all-built-in-role-assignments" >}}) to see all available built-in role assignments.
|
||||
The response contains a mapping between one of the organization roles (`Viewer`, `Editor`, `Admin`) or `Grafana Admin` to the custom or fixed roles.
|
||||
|
||||
Example request:
|
||||
|
||||
```
|
||||
curl --location --request GET '<grafana_url>/api/access-control/builtin-roles' --header 'Authorization: Basic YWRtaW46cGFzc3dvcmQ='
|
||||
```
|
||||
|
||||
Example response:
|
||||
|
||||
```
|
||||
{
|
||||
"Admin": [
|
||||
@@ -34,7 +36,7 @@ Example response:
|
||||
"global": true,
|
||||
"updated": "2021-05-17T20:49:18+02:00",
|
||||
"created": "2021-05-13T16:24:26+02:00"
|
||||
},
|
||||
},
|
||||
{
|
||||
"version": 1,
|
||||
"uid": "Kz9m_YjGz",
|
||||
@@ -56,7 +58,7 @@ Example response:
|
||||
"global": true,
|
||||
"updated": "2021-05-17T20:49:18+02:00",
|
||||
"created": "2021-05-13T16:24:26+02:00"
|
||||
},
|
||||
},
|
||||
{
|
||||
"version": 2,
|
||||
"uid": "ajum_YjGk",
|
||||
@@ -74,8 +76,8 @@ Example response:
|
||||
"global": true,
|
||||
"updated": "2021-05-17T20:49:17+02:00",
|
||||
"created": "2021-05-13T16:24:26+02:00"
|
||||
},
|
||||
...
|
||||
},
|
||||
...
|
||||
]
|
||||
}
|
||||
```
|
||||
@@ -134,6 +136,7 @@ You can create your custom role by either using an [HTTP API]({{< relref "../../
|
||||
You can take a look at [actions and scopes]({{< relref "./provisioning.md#action-definitions" >}}) to decide what permissions would you like to map to your role.
|
||||
|
||||
Example HTTP request:
|
||||
|
||||
```
|
||||
curl --location --request POST '<grafana_url>/api/access-control/roles/' \
|
||||
--header 'Authorization: Basic YWRtaW46cGFzc3dvcmQ=' \
|
||||
@@ -163,7 +166,7 @@ Example response:
|
||||
"global": true,
|
||||
"permissions": [
|
||||
{
|
||||
"action": "users:create"
|
||||
"action": "users:create"
|
||||
"updated": "2021-05-17T22:07:31.569936+02:00",
|
||||
"created": "2021-05-17T22:07:31.569935+02:00"
|
||||
}
|
||||
@@ -173,7 +176,7 @@ Example response:
|
||||
}
|
||||
```
|
||||
|
||||
Once the custom role is created, you can create a built-in role assignment by using an [HTTP API]({{< relref "../../http_api/access_control.md#create-a-built-in-role-assignment" >}}).
|
||||
Once the custom role is created, you can create a built-in role assignment by using an [HTTP API]({{< relref "../../http_api/access_control.md#create-a-built-in-role-assignment" >}}).
|
||||
If you created your role using [Grafana provisioning]({{< relref "./provisioning.md" >}}), you can also create the assignment with it.
|
||||
|
||||
Example HTTP request:
|
||||
@@ -212,8 +215,8 @@ In order to create users, you would need to have `users:create` permission. By d
|
||||
|
||||
If you want to prevent Grafana Admin from creating users, you can do the following:
|
||||
|
||||
1. [Check all built-in role assignments]({{< ref "#check-all-built-in-role-assignments" >}}) to see what built-in role assignments are available.
|
||||
1. From built-in role assignments, find the role which gives `users:create` permission. Refer to [fixed roles]({{< relref "./roles.md#fixed-roles" >}}) for full list of permission assignments.
|
||||
1. [Check all built-in role assignments]({{< ref "#check-all-built-in-role-assignments" >}}) to see what built-in role assignments are available.
|
||||
1. From built-in role assignments, find the role which gives `users:create` permission. Refer to [fixed roles]({{< relref "./roles.md#fixed-roles" >}}) for full list of permission assignments.
|
||||
1. Remove the built-in role assignment by using an [Fine-grained access control HTTP API]({{< relref "../../http_api/access_control.md" >}}) or by using [Grafana provisioning]({{< relref "./provisioning" >}}).
|
||||
|
||||
## Allow Editors to create new custom roles
|
||||
@@ -223,4 +226,4 @@ By default, Grafana Server Admin is the only user who can create and manage cust
|
||||
1. First option is to create a built-in role assignment and map `fixed:permissions:admin:edit` and `fixed:permissions:admin:read` fixed roles to the `Editor` built-in role.
|
||||
1. Second option is to [create a custom role]({{< ref "#create-your-custom-role" >}}) with `roles.builtin:add` and `roles:write` permissions, and create a built-in role assignment for `Editor` organization role.
|
||||
|
||||
Note that in any scenario, your `Editor` would be able to create and manage roles only with the permissions they have, or with a subset of them.
|
||||
Note that in any scenario, your `Editor` would be able to create and manage roles only with the permissions they have, or with a subset of them.
|
||||
|
||||
@@ -22,43 +22,43 @@ Audit logs are JSON objects representing user actions like:
|
||||
|
||||
Audit logs contain the following fields. The fields followed by **\*** are always available, the others depend on the type of action logged.
|
||||
|
||||
| Field name | Type | Description |
|
||||
| ---------- | ---- | ----------- |
|
||||
| `timestamp`\* | string | The date and time the request was made, in coordinated universal time (UTC) using the [RFC3339](https://tools.ietf.org/html/rfc3339#section-5.6) format. |
|
||||
| `user`\* | object | Information about the user that made the request. Either one of the `UserID` or `ApiKeyID` fields will contain content if `isAnonymous=false`. |
|
||||
| `user.userId` | number | ID of the Grafana user that made the request. |
|
||||
| `user.orgId`\* | number | Current organization of the user that made the request. |
|
||||
| `user.orgRole` | string | Current role of the user that made the request. |
|
||||
| `user.name` | string | Name of the Grafana user that made the request. |
|
||||
| `user.tokenId` | number | ID of the user authentication token. |
|
||||
| `user.apiKeyId` | number | ID of the Grafana API key used to make the request. |
|
||||
| `user.isAnonymous`\* | boolean | If an anonymous user made the request, `true`. Otherwise, `false`. |
|
||||
| `action`\* | string | The request action. For example, `create`, `update`, or `manage-permissions`. |
|
||||
| `request`\* | object | Information about the HTTP request. |
|
||||
| `request.params` | object | Request’s path parameters. |
|
||||
| `request.query` | object | Request’s query parameters. |
|
||||
| `request.body` | string | Request’s body. |
|
||||
| `result`\* | object | Information about the HTTP response. |
|
||||
| `result.statusType` | string | If the request action was successful, `success`. Otherwise, `failure`. |
|
||||
| `result.statusCode` | number | HTTP status of the request. |
|
||||
| `result.failureMessage` | string | HTTP error message. |
|
||||
| `result.body` | string | Response body. |
|
||||
| `resources` | array | Information about the resources that the request action affected. This field can be null for non-resource actions such as `login` or `logout`. |
|
||||
| `resources[x].id`\* | number | ID of the resource. |
|
||||
| `resources[x].type`\* | string | The type of the resource that was logged: `alert`, `alert-notification`, `annotation`, `api-key`, `auth-token`, `dashboard`, `datasource`, `folder`, `org`, `panel`, `playlist`, `report`, `team`, `user`, or `version`. |
|
||||
| `requestUri`\* | string | Request URI. |
|
||||
| `ipAddress`\* | string | IP address that the request was made from. |
|
||||
| `userAgent`\* | string | Agent through which the request was made. |
|
||||
| `grafanaVersion`\* | string | Current version of Grafana when this log is created. |
|
||||
| `additionalData` | object | Additional information that can be provided about the request. |
|
||||
| Field name | Type | Description |
|
||||
| ----------------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
||||
| `timestamp`\* | string | The date and time the request was made, in coordinated universal time (UTC) using the [RFC3339](https://tools.ietf.org/html/rfc3339#section-5.6) format. |
|
||||
| `user`\* | object | Information about the user that made the request. Either one of the `UserID` or `ApiKeyID` fields will contain content if `isAnonymous=false`. |
|
||||
| `user.userId` | number | ID of the Grafana user that made the request. |
|
||||
| `user.orgId`\* | number | Current organization of the user that made the request. |
|
||||
| `user.orgRole` | string | Current role of the user that made the request. |
|
||||
| `user.name` | string | Name of the Grafana user that made the request. |
|
||||
| `user.tokenId` | number | ID of the user authentication token. |
|
||||
| `user.apiKeyId` | number | ID of the Grafana API key used to make the request. |
|
||||
| `user.isAnonymous`\* | boolean | If an anonymous user made the request, `true`. Otherwise, `false`. |
|
||||
| `action`\* | string | The request action. For example, `create`, `update`, or `manage-permissions`. |
|
||||
| `request`\* | object | Information about the HTTP request. |
|
||||
| `request.params` | object | Request’s path parameters. |
|
||||
| `request.query` | object | Request’s query parameters. |
|
||||
| `request.body` | string | Request’s body. |
|
||||
| `result`\* | object | Information about the HTTP response. |
|
||||
| `result.statusType` | string | If the request action was successful, `success`. Otherwise, `failure`. |
|
||||
| `result.statusCode` | number | HTTP status of the request. |
|
||||
| `result.failureMessage` | string | HTTP error message. |
|
||||
| `result.body` | string | Response body. |
|
||||
| `resources` | array | Information about the resources that the request action affected. This field can be null for non-resource actions such as `login` or `logout`. |
|
||||
| `resources[x].id`\* | number | ID of the resource. |
|
||||
| `resources[x].type`\* | string | The type of the resource that was logged: `alert`, `alert-notification`, `annotation`, `api-key`, `auth-token`, `dashboard`, `datasource`, `folder`, `org`, `panel`, `playlist`, `report`, `team`, `user`, or `version`. |
|
||||
| `requestUri`\* | string | Request URI. |
|
||||
| `ipAddress`\* | string | IP address that the request was made from. |
|
||||
| `userAgent`\* | string | Agent through which the request was made. |
|
||||
| `grafanaVersion`\* | string | Current version of Grafana when this log is created. |
|
||||
| `additionalData` | object | Additional information that can be provided about the request. |
|
||||
|
||||
The `additionalData` field can contain the following information:
|
||||
| Field name | Action | Description |
|
||||
| ---------- | ------ | ----------- |
|
||||
| `loginUsername` | `login` | Login used in the Grafana authentication form. |
|
||||
| `extUserInfo` | `login` | User information provided by the external system that was used to log in. |
|
||||
| `extUserInfo` | `login` | User information provided by the external system that was used to log in. |
|
||||
| `authTokenCount` | `login` | Number of active authentication tokens for the user that logged in. |
|
||||
| `terminationReason` | `logout` | The reason why the user logged out, such as a manual logout or a token expiring. |
|
||||
| `terminationReason` | `logout` | The reason why the user logged out, such as a manual logout or a token expiring. |
|
||||
|
||||
### Recorded actions
|
||||
|
||||
|
||||
@@ -52,7 +52,7 @@ After you have enabled permissions for a data source you can assign query permis
|
||||
|
||||
If you have enabled permissions for a data source and want to return data source permissions to the default, then you can disable permissions with a click of a button.
|
||||
|
||||
Note that *all* existing permissions created for the data source will be deleted.
|
||||
Note that _all_ existing permissions created for the data source will be deleted.
|
||||
|
||||
**Disable permissions for a data source:**
|
||||
|
||||
|
||||
@@ -362,6 +362,7 @@ This value limits the size of a single cache value. If a cache value (or query r
|
||||
The default is `1`.
|
||||
|
||||
## [caching.encryption]
|
||||
|
||||
### enabled
|
||||
|
||||
When 'enabled' is `true`, query values in the cache are encrypted.
|
||||
|
||||
@@ -17,7 +17,7 @@ To download your Grafana Enterprise license:
|
||||
1. Log in to your [Grafana Cloud Account](https://grafana.com).
|
||||
1. Go to your **Org Profile**.
|
||||
1. Go to the section for Grafana Enterprise licenses in the side menu.
|
||||
1. At the bottom of the license details page there is **Download Token** link that will download the *license.jwt* file containing your license to your computer.
|
||||
1. At the bottom of the license details page there is **Download Token** link that will download the _license.jwt_ file containing your license to your computer.
|
||||
|
||||
## Step 2. Add your license to a Grafana instance
|
||||
|
||||
@@ -34,29 +34,29 @@ This is the preferred option for single instance installations of Grafana Enterp
|
||||
|
||||
### Place the license.jwt file in Grafana's data folder
|
||||
|
||||
The data folder is usually `/var/lib/grafana` on Linux systems.
|
||||
The data folder is usually `/var/lib/grafana` on Linux systems.
|
||||
|
||||
You can also configure a custom location for the license file using the grafana.ini setting:
|
||||
You can also configure a custom location for the license file using the grafana.ini setting:
|
||||
|
||||
```bash
|
||||
[enterprise]
|
||||
license_path = /company/secrets/license.jwt
|
||||
```
|
||||
```bash
|
||||
[enterprise]
|
||||
license_path = /company/secrets/license.jwt
|
||||
```
|
||||
|
||||
This setting can also be set with an environment variable, which is useful if you're running Grafana with Docker and have a custom volume where you have placed the license file. In this case, set the environment variable `GF_ENTERPRISE_LICENSE_PATH` to point to the location of your license file.
|
||||
This setting can also be set with an environment variable, which is useful if you're running Grafana with Docker and have a custom volume where you have placed the license file. In this case, set the environment variable `GF_ENTERPRISE_LICENSE_PATH` to point to the location of your license file.
|
||||
|
||||
### Set the content of the license file as a configuration option
|
||||
|
||||
You can add a license by pasting the content of the `license.jwt`
|
||||
to the grafana.ini configuration file:
|
||||
You can add a license by pasting the content of the `license.jwt`
|
||||
to the grafana.ini configuration file:
|
||||
|
||||
```bash
|
||||
[enterprise]
|
||||
license_text = eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0aGlzIjoiaXMiLCJub3QiOiJhIiwidmFsaWQiOiJsaWNlbnNlIn0.bxDzxIoJlYMwiEYKYT_l2s42z0Y30tY-6KKoyz9RuLE
|
||||
```
|
||||
|
||||
This option can be set using the `GF_ENTERPRISE_LICENSE_TEXT`
|
||||
environment variable.
|
||||
```bash
|
||||
[enterprise]
|
||||
license_text = eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0aGlzIjoiaXMiLCJub3QiOiJhIiwidmFsaWQiOiJsaWNlbnNlIn0.bxDzxIoJlYMwiEYKYT_l2s42z0Y30tY-6KKoyz9RuLE
|
||||
```
|
||||
|
||||
This option can be set using the `GF_ENTERPRISE_LICENSE_TEXT`
|
||||
environment variable.
|
||||
|
||||
## Step 3. Ensure that the license file's root URL matches the root_url configuration option
|
||||
|
||||
|
||||
@@ -21,13 +21,14 @@ Grafana licenses allow for a certain number of active users per instance. An act
|
||||
In the context of licensing, each user is classified as either a viewer or an editor/admin. This classification is the user's **licensed role**, and it can be different from that user's [organization role]({{< relref "../../permissions/organization_roles.md" >}}) in Grafana.
|
||||
|
||||
- An editor/admin is a user who has permission to edit and save a dashboard. Examples of editors are as follows:
|
||||
- Grafana server administrators.
|
||||
- Users who are assigned an organization role of Editor or Admin.
|
||||
- Users who have been granted admin or edit permissions at the dashboard or folder level. Refer to [Dashboard and folder permissions]({{< relref "../../permissions/dashboard-folder-permissions.md" >}}). This means that even if a user is assigned to an organization role of Viewer they will be counted as an editor.
|
||||
- Grafana server administrators.
|
||||
- Users who are assigned an organization role of Editor or Admin.
|
||||
- Users who have been granted admin or edit permissions at the dashboard or folder level. Refer to [Dashboard and folder permissions]({{< relref "../../permissions/dashboard-folder-permissions.md" >}}). This means that even if a user is assigned to an organization role of Viewer they will be counted as an editor.
|
||||
- A viewer is a user with the Viewer role, which does not permit the user to save a dashboard.
|
||||
|
||||
Additional details:
|
||||
- When the number of maximum active viewers or editor/admins is reached, only those currently active users can sign in. New users or non-active users cannot sign in.
|
||||
|
||||
- When the number of maximum active viewers or editor/admins is reached, only those currently active users can sign in. New users or non-active users cannot sign in.
|
||||
- A license limit banner will appear to admins when Grafana reaches its active user limit. Editor/admins and viewers will not see the banner.
|
||||
- To see how many active users you have in each licensed role (Viewer or Editor/Admin), refer to the Licensing page in the Server Admin section of Grafana, which is located at `[your-grafana-url.com]/admin/licensing`. Please note that _licensed_ roles can differ from the Active Viewer/Editor/Admin counts on the /admin/stats page in Grafana. This is because the Stats page only counts a user's assigned organization role and does not account for dashboard and folder permissions.
|
||||
- Restrictions are applied separately for viewers and editor/admins. If a Grafana instance reaches its limit of active viewers but not its limit of active editor/admins, new editors and admins will still be able to sign in.
|
||||
@@ -59,6 +60,7 @@ License URL is the root URL of your Grafana instance. The license will not work
|
||||
This CSV report helps to identify users, teams, and roles that have been granted Admin or Edit permissions at the dashboard or folder level.
|
||||
|
||||
To download the report:
|
||||
|
||||
1. Hover your cursor over the **Server Admin** (shield) icon in the side menu and then click **Licensing**.
|
||||
1. At the bottom of the page, click **Download report**.
|
||||
|
||||
|
||||
@@ -30,6 +30,7 @@ You can make a panel retrieve fresh data more frequently by increasing the **Max
|
||||
## Data sources that work with query caching
|
||||
|
||||
Query caching works for all [Enterprise data sources](https://grafana.com/grafana/plugins/?type=datasource&enterprise=1), and it works for the following [built-in data sources]({{< relref "../datasources/_index.md" >}}):
|
||||
|
||||
- CloudWatch
|
||||
- Google Cloud Monitoring
|
||||
- InfluxDB
|
||||
@@ -49,11 +50,12 @@ To tell if a data source works with query caching, follow the instructions below
|
||||
You must be an Org admin or Grafana admin to enable query caching for a data source. For more information on Grafana roles and permissions, visit the [Permissions page]({{< relref "../permissions/_index.md" >}}).
|
||||
|
||||
By default, data source queries are not cached. To enable query caching for a single data source:
|
||||
|
||||
1. On the side menu, click Configuration > Data Sources.
|
||||
1. In the data source list, click the data source that you want to turn on caching for.
|
||||
1. In the Cache tab, click Enable.
|
||||
1. Open the Cache tab.
|
||||
1. Press the Enable button.
|
||||
1. Press the Enable button.
|
||||
1. (Optional) Choose a custom TTL for that data source. If you skip this step, then Grafana uses the default TTL.
|
||||
|
||||
> **Note:** If query caching is enabled and the Cache tab is not visible in a data source's settings, then query caching is not available for that data source.
|
||||
@@ -62,7 +64,8 @@ To configure global settings for query caching, refer the the [Query caching sec
|
||||
|
||||
## Disable query caching
|
||||
|
||||
To disable query caching for a single data source:
|
||||
To disable query caching for a single data source:
|
||||
|
||||
1. On the side menu, click Configuration > Data Sources.
|
||||
1. In the data source list, click the data source that you want to turn off caching for.
|
||||
1. In the Cache tab, click Disable.
|
||||
|
||||
@@ -11,7 +11,7 @@ weight = 800
|
||||
Reporting allows you to automatically generate PDFs from any of your dashboards and have Grafana email them to interested parties on a schedule. This is available in Grafana Cloud Pro and Advanced and in Grafana Enterprise.
|
||||
|
||||
> If you have [Fine-grained access Control]({{< relref "../enterprise/access-control/_index.md" >}}) enabled, for some actions you would need to have relevant permissions.
|
||||
Refer to specific guides to understand what permissions are required.
|
||||
> Refer to specific guides to understand what permissions are required.
|
||||
|
||||
{{< figure src="/static/img/docs/enterprise/reports_list_8.1.png" max-width="500px" class="docs-image--no-shadow" >}}
|
||||
|
||||
@@ -86,12 +86,12 @@ If the time zone is set differently between your Grafana server and its remote i
|
||||
|
||||
> We're actively working on developing new report layout options. [Contact us](https://grafana.com/contact?about=grafana-enterprise&topic=design-process&value=reporting) if you would like to get involved in the design process.
|
||||
|
||||
Layout | Orientation | Support | Description | Preview
|
||||
------ | ----------- | ------- | ----------- | -------
|
||||
Simple | Portrait | v6.4+ | Generates an A4 page in portrait mode with three panels per page. | {{< figure src="/static/img/docs/enterprise/reports_portrait_preview.png" max-width="500px" max-height="500px" class="docs-image--no-shadow" >}}
|
||||
Simple | Landscape | v6.7+ | Generates an A4 page in landscape mode with a single panel per page. | {{< figure src="/static/img/docs/enterprise/reports_landscape_preview.png" max-width="500px" class="docs-image--no-shadow" >}}
|
||||
Grid | Portrait | v7.2+ | Generates an A4 page in portrait mode with panels arranged in the same way as at the original dashboard. | {{< figure src="/static/img/docs/enterprise/reports_grid_portrait_preview.png" max-width="500px" max-height="500px" class="docs-image--no-shadow" >}}
|
||||
Grid | Landscape | v7.2+ | Generates an A4 page in landscape mode with panels arranged in the same way as at the original dashboard. | {{< figure src="/static/img/docs/enterprise/reports_grid_landscape_preview.png" max-width="500px" class="docs-image--no-shadow" >}}
|
||||
| Layout | Orientation | Support | Description | Preview |
|
||||
| ------ | ----------- | ------- | --------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| Simple | Portrait | v6.4+ | Generates an A4 page in portrait mode with three panels per page. | {{< figure src="/static/img/docs/enterprise/reports_portrait_preview.png" max-width="500px" max-height="500px" class="docs-image--no-shadow" >}} |
|
||||
| Simple | Landscape | v6.7+ | Generates an A4 page in landscape mode with a single panel per page. | {{< figure src="/static/img/docs/enterprise/reports_landscape_preview.png" max-width="500px" class="docs-image--no-shadow" >}} |
|
||||
| Grid | Portrait | v7.2+ | Generates an A4 page in portrait mode with panels arranged in the same way as at the original dashboard. | {{< figure src="/static/img/docs/enterprise/reports_grid_portrait_preview.png" max-width="500px" max-height="500px" class="docs-image--no-shadow" >}} |
|
||||
| Grid | Landscape | v7.2+ | Generates an A4 page in landscape mode with panels arranged in the same way as at the original dashboard. | {{< figure src="/static/img/docs/enterprise/reports_grid_landscape_preview.png" max-width="500px" class="docs-image--no-shadow" >}} |
|
||||
|
||||
### CSV export
|
||||
|
||||
@@ -106,13 +106,13 @@ When the CSV file is generated, it is temporarily written to the `csv` folder in
|
||||
A background job runs every 10 minutes and removes temporary CSV files. You can configure how long a CSV file should be stored before being removed by configuring the [temp-data-lifetime]({{< relref "../administration/configuration/#temp-data-lifetime" >}}) setting. This setting also affects how long a renderer PNG file should be stored.
|
||||
|
||||
### Scheduling
|
||||
|
||||
> Note: Scheduler has been significantly changed in Grafana Enterprise v8.1.
|
||||
|
||||
Scheduled reports can be sent once or repeatedly on an hourly, daily, weekly, or monthly basis, or at custom intervals. You can also disable scheduling by selecting **Never**: for example, if you want to send the report via the API.
|
||||
|
||||
{{< figure src="/static/img/docs/enterprise/reports_scheduler_8.1.png" max-width="500px" class="docs-image--no-shadow" >}}
|
||||
|
||||
|
||||
**Send now or schedule for later**
|
||||
|
||||
- **Send now** sends the report immediately after you save it. To stop sending the report at some point in the future, add an end date. If you leave the end date empty, the report is sent out indefinitely.
|
||||
@@ -133,7 +133,7 @@ When you schedule a report with a monthly frequency, and set the start date betw
|
||||
|
||||
1. In the report, click **Send test email**.
|
||||
1. In the Email field, enter the email address or addresses that you want to test, separated by semicolon.
|
||||
If you want to use email addresses from the report, then select the **Use emails from report** check box.
|
||||
If you want to use email addresses from the report, then select the **Use emails from report** check box.
|
||||
1. Click **Send**.
|
||||
|
||||
The last saved version of the report will be sent to selected emails. You can use this to verify emails are working and to make sure the report is generated and displayed as you expect.
|
||||
@@ -144,7 +144,7 @@ The last saved version of the report will be sent to selected emails. You can us
|
||||
|
||||
> **Note:** Available in Grafana Enterprise v8+.
|
||||
|
||||
You can pause sending of reports from the report list view by clicking the pause icon. The report will not be sent according to its schedule until it is resumed by clicking the resume button on the report row.
|
||||
You can pause sending of reports from the report list view by clicking the pause icon. The report will not be sent according to its schedule until it is resumed by clicking the resume button on the report row.
|
||||
|
||||
## Send report via the API
|
||||
|
||||
@@ -193,6 +193,7 @@ Report branding:
|
||||
**Company logo URL** - Company logo displayed in the report PDF. Defaults to the Grafana logo.
|
||||
|
||||
Email branding:
|
||||
|
||||
- **Company logo URL** - Company logo displayed in the report PDF. Defaults to the Grafana logo.
|
||||
- **Email footer** - Toggle to enable report email footer. Select **Sent by** or **None**.
|
||||
- **Footer link text** - Text for the link in the report email footer. Defaults to "Grafana".
|
||||
|
||||
@@ -12,6 +12,7 @@ weight = 400
|
||||
Request security makes it possible to limit requests from the Grafana server, and it targets requests that are generated by users.
|
||||
|
||||
For example:
|
||||
|
||||
- Data source metric queries
|
||||
- Alert notifications
|
||||
|
||||
|
||||
@@ -19,6 +19,7 @@ The SAML single sign-on (SSO) standard is varied and flexible. Our implementatio
|
||||
Grafana supports the following SAML 2.0 bindings:
|
||||
|
||||
- From the Service Provider (SP) to the Identity Provider (IdP):
|
||||
|
||||
- `HTTP-POST` binding
|
||||
- `HTTP-Redirect` binding
|
||||
|
||||
@@ -26,10 +27,12 @@ Grafana supports the following SAML 2.0 bindings:
|
||||
- `HTTP-POST` binding
|
||||
|
||||
In terms of security:
|
||||
|
||||
- Grafana supports signed and encrypted assertions.
|
||||
- Grafana does not support signed or encrypted requests.
|
||||
|
||||
In terms of initiation:
|
||||
|
||||
- Grafana supports SP-initiated requests.
|
||||
- Grafana does not support IdP-initiated request.
|
||||
|
||||
@@ -37,29 +40,29 @@ In terms of initiation:
|
||||
|
||||
The table below describes all SAML configuration options. Continue reading below for details on specific options. Like any other Grafana configuration, you can apply these options as [environment variables]({{< relref "../administration/configuration.md#configure-with-environment-variables" >}}).
|
||||
|
||||
| Setting | Required | Description | Default |
|
||||
| ----------------------------------------------------------- | -------- | --------------------------------------------------------------------------------------------- | ------------- |
|
||||
| `enabled` | No | Whether SAML authentication is allowed | `false` |
|
||||
| `single_logout` | No | Whether SAML Single Logout enabled | `false` |
|
||||
| `allow_idp_initiated` | No | Whether SAML IdP-initiated login is allowed | `false` |
|
||||
| `certificate` or `certificate_path` | Yes | Base64-encoded string or Path for the SP X.509 certificate | |
|
||||
| `private_key` or `private_key_path` | Yes | Base64-encoded string or Path for the SP private key | |
|
||||
| `signature_algorithm` | No | Signature algorithm used for signing requests to the IdP. Supported values are rsa-sha1, rsa-sha256, rsa-sha512. | |
|
||||
| `idp_metadata`, `idp_metadata_path`, or `idp_metadata_url` | Yes | Base64-encoded string, Path or URL for the IdP SAML metadata XML | |
|
||||
| `max_issue_delay` | No | Duration, since the IdP issued a response and the SP is allowed to process it | `90s` |
|
||||
| `metadata_valid_duration` | No | Duration, for how long the SP metadata is valid | `48h` |
|
||||
| `relay_state` | No | Relay state for IdP-initiated login. Should match relay state configured in IdP | |
|
||||
| `assertion_attribute_name` | No | Friendly name or name of the attribute within the SAML assertion to use as the user name | `displayName` |
|
||||
| `assertion_attribute_login` | No | Friendly name or name of the attribute within the SAML assertion to use as the user login handle | `mail` |
|
||||
| `assertion_attribute_email` | No | Friendly name or name of the attribute within the SAML assertion to use as the user email | `mail` |
|
||||
| `assertion_attribute_groups` | No | Friendly name or name of the attribute within the SAML assertion to use as the user groups | |
|
||||
| `assertion_attribute_role` | No | Friendly name or name of the attribute within the SAML assertion to use as the user roles | |
|
||||
| `assertion_attribute_org` | No | Friendly name or name of the attribute within the SAML assertion to use as the user organization | |
|
||||
| `allowed_organizations` | No | List of comma- or space-separated organizations. User should be a member of at least one organization to log in. | |
|
||||
| `org_mapping` | No | List of comma- or space-separated Organization:OrgId mappings | |
|
||||
| `role_values_editor` | No | List of comma- or space-separated roles which will be mapped into the Editor role | |
|
||||
| `role_values_admin` | No | List of comma- or space-separated roles which will be mapped into the Admin role | |
|
||||
| `role_values_grafana_admin` | No | List of comma- or space-separated roles which will be mapped into the Grafana Admin (Super Admin) role | |
|
||||
| Setting | Required | Description | Default |
|
||||
| ---------------------------------------------------------- | -------- | ---------------------------------------------------------------------------------------------------------------- | ------------- |
|
||||
| `enabled` | No | Whether SAML authentication is allowed | `false` |
|
||||
| `single_logout` | No | Whether SAML Single Logout enabled | `false` |
|
||||
| `allow_idp_initiated` | No | Whether SAML IdP-initiated login is allowed | `false` |
|
||||
| `certificate` or `certificate_path` | Yes | Base64-encoded string or Path for the SP X.509 certificate | |
|
||||
| `private_key` or `private_key_path` | Yes | Base64-encoded string or Path for the SP private key | |
|
||||
| `signature_algorithm` | No | Signature algorithm used for signing requests to the IdP. Supported values are rsa-sha1, rsa-sha256, rsa-sha512. | |
|
||||
| `idp_metadata`, `idp_metadata_path`, or `idp_metadata_url` | Yes | Base64-encoded string, Path or URL for the IdP SAML metadata XML | |
|
||||
| `max_issue_delay` | No | Duration, since the IdP issued a response and the SP is allowed to process it | `90s` |
|
||||
| `metadata_valid_duration` | No | Duration, for how long the SP metadata is valid | `48h` |
|
||||
| `relay_state` | No | Relay state for IdP-initiated login. Should match relay state configured in IdP | |
|
||||
| `assertion_attribute_name` | No | Friendly name or name of the attribute within the SAML assertion to use as the user name | `displayName` |
|
||||
| `assertion_attribute_login` | No | Friendly name or name of the attribute within the SAML assertion to use as the user login handle | `mail` |
|
||||
| `assertion_attribute_email` | No | Friendly name or name of the attribute within the SAML assertion to use as the user email | `mail` |
|
||||
| `assertion_attribute_groups` | No | Friendly name or name of the attribute within the SAML assertion to use as the user groups | |
|
||||
| `assertion_attribute_role` | No | Friendly name or name of the attribute within the SAML assertion to use as the user roles | |
|
||||
| `assertion_attribute_org` | No | Friendly name or name of the attribute within the SAML assertion to use as the user organization | |
|
||||
| `allowed_organizations` | No | List of comma- or space-separated organizations. User should be a member of at least one organization to log in. | |
|
||||
| `org_mapping` | No | List of comma- or space-separated Organization:OrgId mappings | |
|
||||
| `role_values_editor` | No | List of comma- or space-separated roles which will be mapped into the Editor role | |
|
||||
| `role_values_admin` | No | List of comma- or space-separated roles which will be mapped into the Admin role | |
|
||||
| `role_values_grafana_admin` | No | List of comma- or space-separated roles which will be mapped into the Grafana Admin (Super Admin) role | |
|
||||
|
||||
### Enable SAML authentication
|
||||
|
||||
@@ -72,6 +75,7 @@ Refer to [Configuration]({{< relref "../administration/configuration.md" >}}) fo
|
||||
The SAML SSO standard uses asymmetric encryption to exchange information between the SP (Grafana) and the IdP. To perform such encryption, you need a public part and a private part. In this case, the X.509 certificate provides the public part, while the private key provides the private part.
|
||||
|
||||
Grafana supports two ways of specifying both the `certificate` and `private_key`.
|
||||
|
||||
- Without a suffix (`certificate` or `private_key`), the configuration assumes you've supplied the base64-encoded file contents.
|
||||
- With the `_path` suffix (`certificate_path` or `private_key_path`), then Grafana treats the value entered as a file path and attempts to read the file from the file system.
|
||||
|
||||
@@ -88,6 +92,7 @@ The SAML standard recommends using a digital signature for some types of message
|
||||
You also need to define the public part of the IdP for message verification. The SAML IdP metadata XML defines where and how Grafana exchanges user information.
|
||||
|
||||
Grafana supports three ways of specifying the IdP metadata.
|
||||
|
||||
- Without a suffix `idp_metadata`, Grafana assumes base64-encoded XML file contents.
|
||||
- With the `_path` suffix, Grafana assumes a file path and attempts to read the file from the file system.
|
||||
- With the `_url` suffix, Grafana assumes a URL and attempts to load the metadata from the given location.
|
||||
@@ -135,7 +140,6 @@ For Grafana to map the user information, it looks at the individual attributes w
|
||||
|
||||
Grafana provides configuration options that let you modify which keys to look at for these values. The data we need to create the user in Grafana is Name, Login handle, and email.
|
||||
|
||||
|
||||
### Configure team sync
|
||||
|
||||
> Team sync support for SAML only available in Grafana v7.0+
|
||||
@@ -241,18 +245,20 @@ To configure SAML integration with Okta, create integration inside the Okta orga
|
||||
1. Click **Create**.
|
||||
1. On the **General Settings** tab, enter a name for your Grafana integration. You can also upload a logo.
|
||||
1. On the **Configure SAML** tab, enter the SAML information related to your Grafana instance:
|
||||
- In the **Single sign on URL** field, use the `/saml/acs` endpoint URL of your Grafana instance, for example, `https://grafana.example.com/saml/acs`.
|
||||
- In the **Audience URI (SP Entity ID)** field, use the `/saml/metadata` endpoint URL, for example, `https://grafana.example.com/saml/metadata`.
|
||||
- Leave the default values for **Name ID format** and **Application username**.
|
||||
- In the **ATTRIBUTE STATEMENTS (OPTIONAL)** section, enter the SAML attributes to be shared with Grafana, for example:
|
||||
|
||||
| Attribute name (in Grafana) | Value (in Okta profile) |
|
||||
| --------------------------- | -------------------------------------- |
|
||||
| Login | `user.login` |
|
||||
| Email | `user.email` |
|
||||
| DisplayName | `user.firstName + " " + user.lastName` |
|
||||
- In the **Single sign on URL** field, use the `/saml/acs` endpoint URL of your Grafana instance, for example, `https://grafana.example.com/saml/acs`.
|
||||
- In the **Audience URI (SP Entity ID)** field, use the `/saml/metadata` endpoint URL, for example, `https://grafana.example.com/saml/metadata`.
|
||||
- Leave the default values for **Name ID format** and **Application username**.
|
||||
- In the **ATTRIBUTE STATEMENTS (OPTIONAL)** section, enter the SAML attributes to be shared with Grafana, for example:
|
||||
|
||||
| Attribute name (in Grafana) | Value (in Okta profile) |
|
||||
| --------------------------- | -------------------------------------- |
|
||||
| Login | `user.login` |
|
||||
| Email | `user.email` |
|
||||
| DisplayName | `user.firstName + " " + user.lastName` |
|
||||
|
||||
- In the **GROUP ATTRIBUTE STATEMENTS (OPTIONAL)** section, enter a group attribute name (for example, `Group`) and set filter to `Matches regex .*` to return all user groups.
|
||||
|
||||
- In the **GROUP ATTRIBUTE STATEMENTS (OPTIONAL)** section, enter a group attribute name (for example, `Group`) and set filter to `Matches regex .*` to return all user groups.
|
||||
1. Click **Next**.
|
||||
1. On the final Feedback tab, fill out the form and then click **Finish**.
|
||||
|
||||
@@ -265,10 +271,10 @@ Once the application is created, configure Grafana to use it for SAML authentica
|
||||
1. On the Okta application page where you have been redirected after application created, navigate to the **Sign On** tab and find **Identity Provider metadata** link in the **Settings** section.
|
||||
1. Set the [`idp_metadata_url`]({{< relref "./enterprise-configuration.md#idp-metadata-url" >}}) to the URL obtained from the previous step. The URL should look like `https://<your-org-id>.okta.com/app/<application-id>/sso/saml/metadata`.
|
||||
1. Set the following options to the attribute names configured at the **step 10** of the SAML integration setup. You can find this attributes on the **General** tab of the application page (**ATTRIBUTE STATEMENTS** and **GROUP ATTRIBUTE STATEMENTS** in the **SAML Settings** section).
|
||||
- [`assertion_attribute_login`]({{< relref "./enterprise-configuration.md#assertion-attribute-login" >}})
|
||||
- [`assertion_attribute_email`]({{< relref "./enterprise-configuration.md#assertion-attribute-email" >}})
|
||||
- [`assertion_attribute_name`]({{< relref "./enterprise-configuration.md#assertion-attribute-name" >}})
|
||||
- [`assertion_attribute_groups`]({{< relref "./enterprise-configuration.md#assertion-attribute-groups" >}})
|
||||
- [`assertion_attribute_login`]({{< relref "./enterprise-configuration.md#assertion-attribute-login" >}})
|
||||
- [`assertion_attribute_email`]({{< relref "./enterprise-configuration.md#assertion-attribute-email" >}})
|
||||
- [`assertion_attribute_name`]({{< relref "./enterprise-configuration.md#assertion-attribute-name" >}})
|
||||
- [`assertion_attribute_groups`]({{< relref "./enterprise-configuration.md#assertion-attribute-groups" >}})
|
||||
1. Save the configuration file and and then restart the Grafana server.
|
||||
|
||||
When you are finished, the Grafana configuration might look like this example:
|
||||
|
||||
@@ -14,11 +14,11 @@ Settings updates at runtime allows you to update Grafana settings with no need t
|
||||
Updates that happen at runtime are stored in the database and override
|
||||
[settings from the other sources](https://grafana.com/docs/grafana/latest/administration/configuration/)
|
||||
(arguments, environment variables, settings file, etc). Therefore, every time a specific setting key is removed at runtime,
|
||||
the value used for that key is the inherited one from the other sources in the reverse order of precedence
|
||||
the value used for that key is the inherited one from the other sources in the reverse order of precedence
|
||||
(`arguments > environment variables > settings file`), being the application default the value used when no one provided
|
||||
through one of these, at least.
|
||||
|
||||
Currently, **it only supports updates on the `auth.saml` section.**
|
||||
Currently, **it only supports updates on the `auth.saml` section.**
|
||||
|
||||
## Update settings via the API
|
||||
|
||||
@@ -27,8 +27,9 @@ You can update settings through the [Admin API]({{< relref "../http_api/admin.md
|
||||
When you submit a settings update via API, Grafana verifies if the given settings updates are allowed and valid. If they are, then Grafana stores the settings in the database and reloads
|
||||
Grafana services with no need to restart the instance.
|
||||
|
||||
So, the payload of a `PUT` request to the update settings endpoint (`/api/admin/settings`)
|
||||
So, the payload of a `PUT` request to the update settings endpoint (`/api/admin/settings`)
|
||||
should contain (either one or both):
|
||||
|
||||
- An `updates` map with a key, and a value per section you want to set.
|
||||
- A `removals` list with keys per section you want to unset.
|
||||
|
||||
@@ -44,7 +45,9 @@ For example, if you provide the following `updates`:
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
it would enable SAML and disable single logouts. And, if you provide the following `removals`:
|
||||
|
||||
```json
|
||||
{
|
||||
"auth.saml": ["allow_idp_initiated"]
|
||||
@@ -77,12 +80,12 @@ won't be persisted into the database.
|
||||
## Background job (high availability set-ups)
|
||||
|
||||
Grafana Enterprise has a built-in scheduled background job that looks into the database every minute for
|
||||
settings updates. If there are updates, it reloads the Grafana services affected by the detected changes.
|
||||
settings updates. If there are updates, it reloads the Grafana services affected by the detected changes.
|
||||
|
||||
The background job synchronizes settings between instances in high availability set-ups. So, after you perform some changes through the
|
||||
HTTP API, then the other instances are synchronized through the database and the background job.
|
||||
|
||||
## Control access with fine-grained access control
|
||||
|
||||
If you have [Fine-grained access Control]({{< relref "../enterprise/access-control/_index.md" >}}) enabled, you can control who can read or update settings.
|
||||
If you have [Fine-grained access Control]({{< relref "../enterprise/access-control/_index.md" >}}) enabled, you can control who can read or update settings.
|
||||
Refer to the [Admin API]({{< relref "../http_api/admin.md#update-settings" >}}) for more information.
|
||||
|
||||
@@ -43,7 +43,7 @@ If you have already grouped some users into a team, then you can synchronize tha
|
||||
1. Insert the value of the group you want to sync with. This becomes the Grafana `GroupID`.
|
||||
Examples:
|
||||
|
||||
- For LDAP, this is the LDAP distinguished name (DN) of LDAP group you want to synchronize with the team.
|
||||
- For Auth Proxy, this is the value we receive as part of the custom `Groups` header.
|
||||
- For LDAP, this is the LDAP distinguished name (DN) of LDAP group you want to synchronize with the team.
|
||||
- For Auth Proxy, this is the value we receive as part of the custom `Groups` header.
|
||||
|
||||
1. Click `Add group` to save.
|
||||
|
||||
@@ -8,14 +8,16 @@ weight = 200
|
||||
|
||||
# Usage insights
|
||||
|
||||
Usage insights allow you to have a better understanding of how your Grafana instance is used.
|
||||
Usage insights allow you to have a better understanding of how your Grafana instance is used.
|
||||
|
||||
The usage insights feature collects a number of aggregated data and stores them in the database:
|
||||
|
||||
- Dashboard views (aggregated and per user)
|
||||
- Data source errors
|
||||
- Data source queries
|
||||
|
||||
These aggregated data give you access to several features:
|
||||
|
||||
- [Dashboard and data source insights]({{< relref "dashboard-datasource-insights.md" >}})
|
||||
- [Presence indicator]({{< relref "presence-indicator.md" >}})
|
||||
- [Sort dashboards by using insights data]({{< relref "improved-search.md" >}})
|
||||
|
||||
@@ -36,6 +36,7 @@ Data source insights give you information about how a data source has been used
|
||||
- Query load time per day (averaged in ms)
|
||||
|
||||
To find data source insights:
|
||||
|
||||
1. Go to the Data source list view.
|
||||
1. Click on a data source.
|
||||
1. Click the **Insights** tab.
|
||||
|
||||
@@ -15,6 +15,7 @@ By exporting usage logs to Loki, you can directly query them and create dashboar
|
||||
## Usage insights logs
|
||||
|
||||
Usage insights logs are JSON objects that represent certain user activities, such as:
|
||||
|
||||
- A user opens a dashboard.
|
||||
- A query is sent to a data source.
|
||||
|
||||
@@ -23,7 +24,8 @@ Usage insights logs are JSON objects that represent certain user activities, suc
|
||||
A log is created every time a user opens a dashboard or when a query is sent to a data source in the dashboard view. A query that is performed via Explore does not generate a log.
|
||||
|
||||
### Format
|
||||
Logs of usage insights contain the following fields, where the fields followed by * are always available, and the others depend on the logged event:
|
||||
|
||||
Logs of usage insights contain the following fields, where the fields followed by \* are always available, and the others depend on the logged event:
|
||||
| Field name | Type | Description |
|
||||
| ---------- | ---- | ----------- |
|
||||
| `eventName`\* | string | Type of the event, which can be either `data-request` or `dashboard-view`. |
|
||||
@@ -69,11 +71,12 @@ tls = true
|
||||
## Visualize Loki usage insights in Grafana
|
||||
|
||||
Now that your logs are exported into Loki, you can build Grafana dashboards to understand your Grafana instance usage.
|
||||
|
||||
1. Add Loki as a data source. Refer to [Grafana fundamentals tutorial](/tutorials/grafana-fundamentals/#6).
|
||||
1. Import one of the following dashboards:
|
||||
* [Usage insights](/grafana/dashboards/13785)
|
||||
* [Usage insights datasource details](/grafana/dashboards/13786)
|
||||
- [Usage insights](/grafana/dashboards/13785)
|
||||
- [Usage insights datasource details](/grafana/dashboards/13786)
|
||||
1. Play with usage insights to understand them:
|
||||
* In Explore, you can use the query `{datasource="gdev-loki",kind="usage_insights"}` to retrieve all logs related to your `gdev-loki` data source.
|
||||
* In a dashboard, you can build a table panel with the query `topk(10, sum by (error) (count_over_time({kind="usage_insights", datasource="gdev-prometheus"} | json | error != "" [$__interval])))` to display the 10 most common errors your users see using the `gdev-prometheus` data source.
|
||||
* In a dashboard, you can build a graph panel with the queries `sum by(host) (count_over_time({kind="usage_insights"} | json | eventName="data-request" | error != "" [$__interval]))` and `sum by(host) (count_over_time({kind="usage_insights"} | json | eventName="data-request" | error = "" [$__interval]))` to show the evolution of the data request count over time. Using `by (host)` allows you to have more information for each Grafana server you have if you have set up Grafana for [high availability](<{{< relref "../../administration/set-up-for-high-availability.md" >}}>).
|
||||
- In Explore, you can use the query `{datasource="gdev-loki",kind="usage_insights"}` to retrieve all logs related to your `gdev-loki` data source.
|
||||
- In a dashboard, you can build a table panel with the query `topk(10, sum by (error) (count_over_time({kind="usage_insights", datasource="gdev-prometheus"} | json | error != "" [$__interval])))` to display the 10 most common errors your users see using the `gdev-prometheus` data source.
|
||||
- In a dashboard, you can build a graph panel with the queries `sum by(host) (count_over_time({kind="usage_insights"} | json | eventName="data-request" | error != "" [$__interval]))` and `sum by(host) (count_over_time({kind="usage_insights"} | json | eventName="data-request" | error = "" [$__interval]))` to show the evolution of the data request count over time. Using `by (host)` allows you to have more information for each Grafana server you have if you have set up Grafana for [high availability](<{{< relref "../../administration/set-up-for-high-availability.md" >}}>).
|
||||
|
||||
@@ -13,6 +13,7 @@ weight = 400
|
||||
In the search view, you can sort dashboards by using insights data. Doing so helps you find unused or broken dashboards or discover those that are most viewed.
|
||||
|
||||
There are several sort options:
|
||||
|
||||
- Errors total
|
||||
- Errors 30 days
|
||||
- Views total
|
||||
|
||||
@@ -12,7 +12,7 @@ weight = 300
|
||||
|
||||
When you are signed in and looking at any given dashboard, you can know who is looking at the same dashboard as you are via a presence indicator, which displays avatars of users who have interacted with the dashboard recently. The default time frame is within the past 10 minutes. To see the user's name, hover over the user's avatar. The avatars come from [Gravatar](https://gravatar.com) based on the user's email.
|
||||
|
||||
When there are more active users on a dashboard than can fit within the presence indicator, click the **+X** icon. Doing so opens [dashboard insights]({{< relref "dashboard-datasource-insights.md" >}}), which contains more details about recent user activity.
|
||||
When there are more active users on a dashboard than can fit within the presence indicator, click the **+X** icon. Doing so opens [dashboard insights]({{< relref "dashboard-datasource-insights.md" >}}), which contains more details about recent user activity.
|
||||
|
||||
{{< figure src="/static/img/docs/enterprise/presence_indicators.png" max-width="400px" class="docs-image--no-shadow" >}}
|
||||
|
||||
|
||||
@@ -58,6 +58,7 @@ use Vault. Vault configuration is an extension of configuration's [variable expa
|
||||
`$__vault{<argument>}` syntax.
|
||||
|
||||
The argument to Vault consists of three parts separated by a colon:
|
||||
|
||||
- The first part specifies which secrets engine should be used.
|
||||
- The second part specifies which secret should be accessed.
|
||||
- The third part specifies which field of that secret should be used.
|
||||
|
||||
@@ -67,6 +67,7 @@ The configuration file in Grafana Enterprise contains the following options. Eac
|
||||
# Set to complete URL to override loading logo
|
||||
;loading_logo =
|
||||
```
|
||||
|
||||
You can replace the default footer links (Documentation, Support, Community) and even add your own custom links.
|
||||
An example follows for replacing the default footer and help links with new custom links.
|
||||
|
||||
@@ -93,6 +94,7 @@ GF_WHITE_LABELING_FOOTER_LINKS_EXTRACUSTOM_URL=http://your.custom.site
|
||||
```
|
||||
|
||||
> **Note:** The following two links are always present in the footer:
|
||||
|
||||
- Grafana edition
|
||||
- Grafana version with build number
|
||||
|
||||
|
||||
Reference in New Issue
Block a user