diff --git a/docs/sources/setup-grafana/configure-security/configure-authentication/auth-proxy/index.md b/docs/sources/setup-grafana/configure-security/configure-authentication/auth-proxy/index.md index cb6fce182fb..4f68b74a5f2 100644 --- a/docs/sources/setup-grafana/configure-security/configure-authentication/auth-proxy/index.md +++ b/docs/sources/setup-grafana/configure-security/configure-authentication/auth-proxy/index.md @@ -9,7 +9,8 @@ keywords: - documentation - proxy title: Configure auth proxy authentication -weight: 1300 +menuTitle: Auth proxy +weight: 1500 --- # Configure auth proxy authentication diff --git a/docs/sources/setup-grafana/configure-security/configure-authentication/azuread/index.md b/docs/sources/setup-grafana/configure-security/configure-authentication/azuread/index.md index bc997883bc8..b654d7f69e2 100644 --- a/docs/sources/setup-grafana/configure-security/configure-authentication/azuread/index.md +++ b/docs/sources/setup-grafana/configure-security/configure-authentication/azuread/index.md @@ -8,7 +8,8 @@ keywords: - documentation - oauth title: Configure Azure AD OAuth2 authentication -weight: 600 +menuTitle: Azure AD OAuth2 +weight: 800 --- # Configure Azure AD OAuth2 authentication diff --git a/docs/sources/setup-grafana/configure-security/configure-authentication/enhanced-ldap/index.md b/docs/sources/setup-grafana/configure-security/configure-authentication/enhanced-ldap/index.md index 947fab9e93f..627b79ba9f6 100644 --- a/docs/sources/setup-grafana/configure-security/configure-authentication/enhanced-ldap/index.md +++ b/docs/sources/setup-grafana/configure-security/configure-authentication/enhanced-ldap/index.md @@ -11,7 +11,8 @@ keywords: - active directory - enterprise title: Configure enhanced LDAP integration -weight: 900 +menuTitle: Enhanced LDAP +weight: 400 --- # Configure enhanced LDAP integration diff --git a/docs/sources/setup-grafana/configure-security/configure-authentication/generic-oauth/index.md b/docs/sources/setup-grafana/configure-security/configure-authentication/generic-oauth/index.md index 73d0c2aa9dd..108c91955bc 100644 --- a/docs/sources/setup-grafana/configure-security/configure-authentication/generic-oauth/index.md +++ b/docs/sources/setup-grafana/configure-security/configure-authentication/generic-oauth/index.md @@ -7,15 +7,16 @@ keywords: - configuration - documentation - oauth -title: Configure generic OAuth authentication -weight: 200 +title: Configure generic OAuth2 authentication +menuTitle: Generic OAuth2 +weight: 700 --- -# Configure generic OAuth authentication +# Configure generic OAuth2 authentication You can configure many different OAuth2 authentication services with Grafana using the generic OAuth2 feature. Examples: -- [Configure generic OAuth authentication](#configure-generic-oauth-authentication) +- [Configure generic OAuth authentication](#configure-generic-oauth2-authentication) - [Email address](#email-address) - [Groups / Teams](#groups--teams) - [Login](#login) diff --git a/docs/sources/setup-grafana/configure-security/configure-authentication/github/index.md b/docs/sources/setup-grafana/configure-security/configure-authentication/github/index.md index 8e67cfaf7a4..0233fca5adb 100644 --- a/docs/sources/setup-grafana/configure-security/configure-authentication/github/index.md +++ b/docs/sources/setup-grafana/configure-security/configure-authentication/github/index.md @@ -7,8 +7,9 @@ keywords: - configuration - documentation - oauth -title: Configure GitHub OAuth2 Authentication -weight: 1400 +title: Configure GitHub OAuth2 authentication +menuTitle: GitHub OAuth2 +weight: 900 --- # Configure GitHub OAuth2 authentication diff --git a/docs/sources/setup-grafana/configure-security/configure-authentication/gitlab/index.md b/docs/sources/setup-grafana/configure-security/configure-authentication/gitlab/index.md index e754cc1620e..aa58328e9ed 100644 --- a/docs/sources/setup-grafana/configure-security/configure-authentication/gitlab/index.md +++ b/docs/sources/setup-grafana/configure-security/configure-authentication/gitlab/index.md @@ -8,7 +8,8 @@ keywords: - documentation - oauth title: Configure GitLab OAuth2 authentication -weight: 700 +menuTitle: GitLab OAuth2 +weight: 1000 --- # Configure GitLab OAuth2 authentication diff --git a/docs/sources/setup-grafana/configure-security/configure-authentication/google/index.md b/docs/sources/setup-grafana/configure-security/configure-authentication/google/index.md index 5dd85bfdfae..92c77ec9f06 100644 --- a/docs/sources/setup-grafana/configure-security/configure-authentication/google/index.md +++ b/docs/sources/setup-grafana/configure-security/configure-authentication/google/index.md @@ -2,8 +2,9 @@ aliases: - ../../../auth/google/ description: Grafana OAuthentication Guide -title: Configure Google OAuth2 Authentication -weight: 300 +title: Configure Google OAuth2 authentication +menuTitle: Google OAuth2 +weight: 1100 --- # Configure Google OAuth2 authentication diff --git a/docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md b/docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md index bfa992767fc..dec488b2785 100644 --- a/docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md +++ b/docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md @@ -3,7 +3,8 @@ aliases: - ../../../auth/grafana-com/ description: Grafana Com Authentication title: Configure Grafana Com authentication -weight: 500 +menuTitle: Grafana Com OAuth2 +weight: 1200 --- # Configure Grafana Com authentication diff --git a/docs/sources/setup-grafana/configure-security/configure-authentication/grafana/index.md b/docs/sources/setup-grafana/configure-security/configure-authentication/grafana/index.md index 16e63db0559..d93ecdf697f 100644 --- a/docs/sources/setup-grafana/configure-security/configure-authentication/grafana/index.md +++ b/docs/sources/setup-grafana/configure-security/configure-authentication/grafana/index.md @@ -3,7 +3,8 @@ aliases: - ../../../auth/grafana/ description: Grafana OAuthentication Guide title: Configure Grafana authentication -weight: 1000 +menuTitle: Basic auth +weight: 200 --- ## Configure Grafana authentication diff --git a/docs/sources/setup-grafana/configure-security/configure-authentication/jwt/index.md b/docs/sources/setup-grafana/configure-security/configure-authentication/jwt/index.md index ec7a2725ba1..bfb1027ec2d 100644 --- a/docs/sources/setup-grafana/configure-security/configure-authentication/jwt/index.md +++ b/docs/sources/setup-grafana/configure-security/configure-authentication/jwt/index.md @@ -2,8 +2,9 @@ aliases: - ../../../auth/jwt/ description: Grafana JWT Authentication -title: Configure JWT Authentication -weight: 500 +title: Configure JWT authentication +menuTitle: JWT +weight: 1600 --- # Configure JWT authentication diff --git a/docs/sources/setup-grafana/configure-security/configure-authentication/keycloak/index.md b/docs/sources/setup-grafana/configure-security/configure-authentication/keycloak/index.md index ac88eaad66a..818f0c8ef17 100644 --- a/docs/sources/setup-grafana/configure-security/configure-authentication/keycloak/index.md +++ b/docs/sources/setup-grafana/configure-security/configure-authentication/keycloak/index.md @@ -9,7 +9,8 @@ keywords: - documentation - oauth title: Configure Keycloak OAuth2 authentication -weight: 200 +menuTitle: Keycloak OAuth2 +weight: 1300 --- # Configure Keycloak OAuth2 authentication diff --git a/docs/sources/setup-grafana/configure-security/configure-authentication/ldap/index.md b/docs/sources/setup-grafana/configure-security/configure-authentication/ldap/index.md index 318ae720744..a1331a61bb4 100644 --- a/docs/sources/setup-grafana/configure-security/configure-authentication/ldap/index.md +++ b/docs/sources/setup-grafana/configure-security/configure-authentication/ldap/index.md @@ -3,8 +3,9 @@ aliases: - ../../../auth/ldap/ - ../../../installation/ldap/ description: Grafana LDAP Authentication Guide -title: Configure LDAP Authentication -weight: 800 +title: Configure LDAP authentication +menuTitle: LDAP +weight: 300 --- # Configure LDAP authentication diff --git a/docs/sources/setup-grafana/configure-security/configure-authentication/okta/index.md b/docs/sources/setup-grafana/configure-security/configure-authentication/okta/index.md index b84b76eb652..ea7eb808590 100644 --- a/docs/sources/setup-grafana/configure-security/configure-authentication/okta/index.md +++ b/docs/sources/setup-grafana/configure-security/configure-authentication/okta/index.md @@ -3,7 +3,8 @@ aliases: - ../../../auth/okta/ description: Grafana Okta OAuth Guide title: Configure Okta OAuth2 authentication -weight: 1200 +menuTitle: Okta OAuth2 +weight: 1400 --- # Configure Okta OAuth2 authentication diff --git a/docs/sources/setup-grafana/configure-security/configure-authentication/saml-ui/index.md b/docs/sources/setup-grafana/configure-security/configure-authentication/saml-ui/index.md new file mode 100644 index 00000000000..0a377d95c39 --- /dev/null +++ b/docs/sources/setup-grafana/configure-security/configure-authentication/saml-ui/index.md @@ -0,0 +1,99 @@ +--- +description: Learn how to configure SAML authentication in Grafana's UI. +menuTitle: SAML user interface +title: Configure SAML authentication using the Grafana user interface +weight: 600 +--- + +# Configure SAML authentication using the Grafana user interface + +{{% admonition type="note" %}} +Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise" >}}) version 10.0 and later, and [Grafana Cloud Pro and Advanced](/docs/grafana-cloud/). +{{% /admonition %}} + +You can configure SAML authentication in Grafana through the user interface (UI) or the Grafana configuration file. For instructions on how to set up SAML using the Grafana configuration file, refer to [Configure SAML authentication using the configuration file]({{< relref "../saml" >}}). + +The Grafana SAML UI provides the following advantages over configuring SAML in the Grafana configuration file: + +- It is accessible by Grafana Cloud users +- SAML UI carries out input validation and provides useful feedback on the correctness of the configuration, making SAML setup easier +- It doesn't require Grafana to be restarted after a configuration update +- Access to the SAML UI only requires access to authentication settings, so it can be used by users with limited access to Grafana's configuration + +{{% admonition type="note" %}} +Any configuration changes made through the Grafana user interface (UI) will take precedence over settings specified in the Grafana configuration file or through environment variables. This means that if you modify any configuration settings in the UI, they will override any corresponding settings set via environment variables or defined in the configuration file. For more information on how Grafana determines the order of precedence for its settings, please refer to the [Settings update at runtime]({{< relref "../../../configure-grafana/settings-updates-at-runtime" >}}). +{{% /admonition %}} + +{{% admonition type="note" %}} +Disabling the UI does not affect any configuration settings that were previously set up through the UI. Those settings will continue to function as intended even with the UI disabled. +{{% /admonition %}} + +## Before you begin + +To follow this guide, you need: + +- Knowledge of SAML authentication. Refer to [SAML authentication in Grafana]({{< relref "../saml" >}}) for an overview of Grafana's SAML integration. +- Permissions `settings:read` and `settings:write` with scope `settings:auth.saml:*` that allow you to read and update SAML authentication settings. + + These permissions are granted by `fixed:authentication.config:writer` role. + By default, this role is granted to Grafana server administrator in self-hosted instances and to Organization admins in Grafana Cloud instances. + +- Grafana instance running Grafana version 10.0 or later with [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise" >}}) or [Grafana Cloud Pro or Advanced](/docs/grafana-cloud/) license. + +## Steps + +Follow these steps to configure and enable SAML integration: + +1. Sign in to Grafana and navigate to **Administration > Authentication > Configure SAML**. +1. Complete the **General settings** fields. + + For assistance, consult the following table for additional guidance about certain fields: + +| Field | Description | +| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| **Allow signup** | If enabled, you can create new users through the SAML login. If disabled, then only existing Grafana users can log in with SAML. | +| **Auto login** | If enabled, Grafana will attempt to automatically log in with SAML skipping the login screen. | +| **Single logout** | The SAML single logout feature enables users to log out from all applications associated with the current IdP session established using SAML SSO. For more information, refer to [SAML single logout documentation]]({{< relref "../saml#single-logout" >}}). | +| **Identity provider initiated login** | Enables users to log in to Grafana directly from the SAML IdP. For more information, refer to [IdP initiated login documentation]({{< relref "../saml#idp-initiated-single-sign-on-sso" >}}). | + +3. Click **Next: Key and certificate**. +1. Provide a certificate and a private key that will be used by the service provider (Grafana) and the SAML IdP. + + Use the [PKCS #8](https://en.wikipedia.org/wiki/PKCS_8) format to issue the private key. + + For more information, refer to an [example on how to generate SAML credentials]({{< relref "../saml#example-of-how-to-generate-saml-credentials" >}}). + +1. In the **Sign requests** field, specify whether you want the outgoing requests to be signed, and, if so, which signature algorithm should be used. + + The SAML standard recommends using a digital signature for some types of messages, like authentication or logout requests to avoid [man-in-the-middle attacks](https://en.wikipedia.org/wiki/Man-in-the-middle_attack). + +1. Click **Next: Connect Grafana with Identity Provider** and complete the section. +1. Click **Next: User mapping**. +1. If you wish to [map user information from SAML assertions]({{< relref "../saml#assertion-mapping" >}}), complete the **Assertion attributes mappings** section. + + You also need to configure the **Groups attribute** field if you want to use team sync. Team sync automatically maps users to Grafana teams based on their SAML group membership. + Learn more about [team sync]({{< relref "../../configure-team-sync" >}}) and [configuring team sync for SAML]({{< relref "../saml#configure-team-sync" >}}). + +1. If you want to automatically assign users' roles based on their SAML roles, complete the **Role mapping** section. + + First, you need to configure the **Role attribute** field to specify which SAML attribute should be used to retrieve SAML role information. + Then enter the SAML roles that you want to map to Grafana roles in **Role mapping** section. If you want to map multiple SAML roles to a Grafana role, separate them by a comma and a space. For example, `Editor: editor, developer`. + + Role mapping will automatically update user's [basic role]({{< relref "../../../../administration/roles-and-permissions/access-control#basic-roles" >}}) based on their SAML roles every time the user logs in to Grafana. + Learn more about [SAML role synchronization]({{< relref "../saml#configure-role-sync" >}}). + +1. If you have multiple organizations and want to automatically add users to organizations, complete the **Org mapping section**. + + First, you need to configure the **Org attribute** field to specify which SAML attribute should be used to retrieve SAML organization information. + Now fill in the **Org mapping** field with mappings from SAML organization to Grafana organization. For example, `Org mapping: Engineering:2, Sales:2` will map users who belong to `Engineering` or `Sales` organizations in SAML to Grafana organization with ID 2. + If you want users to have different roles in different organizations, you can additionally specify a role. For example, `Org mapping: Engineering:2:Editor` will map users who belong to `Engineering` organizations in SAML to Grafana organization with ID 2 and assign them Editor role. + + Organization mapping will automatically update user's organization memberships (and roles, if they have been configured) based on their SAML organization every time the user logs in to Grafana. + Learn more about [SAML organization mapping]({{< relref "../saml#configure-organization-mapping" >}}). + +1. If you want to limit the access to Grafana based on user's SAML organization membership, fill in the **Allowed organizations** field. +1. Click **Next: Test and enable** and then click **Save and enable**. + 1. If there are issues with your configuration, an error message will appear. Refer back to the previous steps to correct the issues and click on `Save and apply` on the top right corner once you are done. +1. If there are no configuration issues, SAML integration status will change to `Enabled`. + Your SAML configuration is now enabled. +1. To disable SAML integration, click `Disable` in the top right corner. diff --git a/docs/sources/setup-grafana/configure-security/configure-authentication/saml/index.md b/docs/sources/setup-grafana/configure-security/configure-authentication/saml/index.md index 282c42400fc..2a065e0537c 100644 --- a/docs/sources/setup-grafana/configure-security/configure-authentication/saml/index.md +++ b/docs/sources/setup-grafana/configure-security/configure-authentication/saml/index.md @@ -8,10 +8,14 @@ aliases: - ../../../enterprise/saml/enable-saml/ - ../../../enterprise/saml/set-up-saml-with-okta/ - ../../../enterprise/saml/troubleshoot-saml/ -description: Learn how to configure SAML authentication in Grafana. -menuTitle: Configure SAML authentication -title: Configure SAML authentication in Grafana -weight: 1100 +description: Learn how to configure SAML authentication in Grafana's configuration file. +menuTitle: SAML +labels: + products: + - cloud + - enterprise +title: Configure SAML authentication using the configuration file +weight: 500 --- # Configure SAML authentication in Grafana