From e4649e7099007d6170fd6df9a1b1fe03021df246 Mon Sep 17 00:00:00 2001 From: Jo Date: Tue, 25 Jul 2023 18:07:16 +0200 Subject: [PATCH] Auth: Add azure warning for conflicting settings (#72289) * add conflicting option debug warning * add warning for Grafana Admin sync in auth config --- docs/sources/setup-grafana/configure-grafana/_index.md | 4 +++- pkg/login/social/azuread_oauth.go | 4 ++++ pkg/login/social/generic_oauth.go | 2 +- 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/docs/sources/setup-grafana/configure-grafana/_index.md b/docs/sources/setup-grafana/configure-grafana/_index.md index 10e67076630..ab2515f4298 100644 --- a/docs/sources/setup-grafana/configure-grafana/_index.md +++ b/docs/sources/setup-grafana/configure-grafana/_index.md @@ -930,12 +930,14 @@ reset to the default organization role on every login. [See `auto_assign_org_rol `skip_org_role_sync` prevents the synchronization of organization roles for a specific OAuth integration, while the deprecated setting `oauth_skip_org_role_update_sync` affects all configured OAuth providers. -`skip_org_role_sync` default value is `false`. +The default value for `skip_org_role_sync` is `false`. With `skip_org_role_sync` set to `false`, the users' organization and role is reset on every new login, based on the external provider's role. See your provider in the tables below. With `skip_org_role_sync` set to `true`, when a user logs in for the first time, Grafana sets the organization role based on the value specified in `auto_assign_org_role` and forces the organization to `auto_assign_org_id` when specified, otherwise it falls back to OrgID `1`. +> **Note**: Enabling `skip_org_role_sync` also disables the synchronization of Grafana Admins from the external provider, as such `allow_assign_grafana_admin` is ignored. + Use this setting when you want to manage the organization roles of your users from within Grafana and be able to manually assign them to multiple organizations, or to prevent synchronization conflicts when they can be synchronized from another provider. The behavior of `oauth_skip_org_role_update_sync` and `skip_org_role_sync`, can be seen in the tables below: diff --git a/pkg/login/social/azuread_oauth.go b/pkg/login/social/azuread_oauth.go index 565541e75c3..3b6d70ad704 100644 --- a/pkg/login/social/azuread_oauth.go +++ b/pkg/login/social/azuread_oauth.go @@ -108,6 +108,10 @@ func (s *SocialAzureAD) UserInfo(ctx context.Context, client *http.Client, token isGrafanaAdmin = &grafanaAdmin } + if s.allowAssignGrafanaAdmin && s.skipOrgRoleSync { + s.log.Debug("allowAssignGrafanaAdmin and skipOrgRoleSync are both set, Grafana Admin role will not be synced, consider setting one or the other") + } + return &BasicUserInfo{ Id: claims.ID, Name: claims.Name, diff --git a/pkg/login/social/generic_oauth.go b/pkg/login/social/generic_oauth.go index 2e2491ca78e..887c19006d2 100644 --- a/pkg/login/social/generic_oauth.go +++ b/pkg/login/social/generic_oauth.go @@ -171,7 +171,7 @@ func (s *SocialGenericOAuth) UserInfo(ctx context.Context, client *http.Client, } if s.allowAssignGrafanaAdmin && s.skipOrgRoleSync { - s.log.Warn("allowAssignGrafanaAdmin and skipOrgRoleSync are both set, Grafana Admin role will not be synced, consider setting one or the other") + s.log.Debug("allowAssignGrafanaAdmin and skipOrgRoleSync are both set, Grafana Admin role will not be synced, consider setting one or the other") } if userInfo.Email == "" {