mirror of https://github.com/grafana/grafana.git
Docs: Azure AD/ Entra ID docs improvements (#96225)
* Add Configuration options to Azure/Entra docs * Update docs/sources/setup-grafana/configure-security/configure-authentication/azuread/index.md Co-authored-by: Vardan Torosyan <vardants@gmail.com> * Address feedback * Address other feedback * Fix link --------- Co-authored-by: Vardan Torosyan <vardants@gmail.com>
This commit is contained in:
Misi
GitHub
parent
3b7c793c37
commit
a2c998ba1d
|
|
@ -51,7 +51,11 @@ To enable the Azure AD OAuth2, register your application with Entra ID.
|
||||||
- Description: Grafana OAuth
|
- Description: Grafana OAuth
|
||||||
- Expires: Select an expiration period
|
- Expires: Select an expiration period
|
||||||
|
|
||||||
1. Click **Add** then copy the key value. This is the OAuth client secret.
|
1. Click **Add** then copy the key **Value**. This is the OAuth client secret.
|
||||||
|
|
||||||
|
{{% admonition type="note" %}}
|
||||||
|
Make sure that you copy the string in the **Value** field, rather than the one in the **Secret ID** field.
|
||||||
|
{{% /admonition %}}
|
||||||
|
|
||||||
1. Define the required application roles for Grafana [using the Azure Portal](#configure-application-roles-for-grafana-in-the-azure-portal) or [using the manifest file](#configure-application-roles-for-grafana-in-the-manifest-file).
|
1. Define the required application roles for Grafana [using the Azure Portal](#configure-application-roles-for-grafana-in-the-azure-portal) or [using the manifest file](#configure-application-roles-for-grafana-in-the-manifest-file).
|
||||||
|
|
||||||
|
|
@ -62,6 +66,10 @@ To enable the Azure AD OAuth2, register your application with Entra ID.
|
||||||
1. Click **Users and Groups**.
|
1. Click **Users and Groups**.
|
||||||
1. Click **Add user/group** to add a user or group to the Grafana roles.
|
1. Click **Add user/group** to add a user or group to the Grafana roles.
|
||||||
|
|
||||||
|
{{% admonition type="note" %}}
|
||||||
|
When assigning a group to a Grafana role, ensure that users are direct members of the group. Users in nested groups will not have access to Grafana due to limitations within Azure AD/Entra ID side. For more information, see [Microsoft Entra service limits and restrictions](https://learn.microsoft.com/en-us/entra/identity/users/directory-service-limits-restrictions).
|
||||||
|
{{% /admonition %}}
|
||||||
|
|
||||||
### Configure application roles for Grafana in the Azure Portal
|
### Configure application roles for Grafana in the Azure Portal
|
||||||
|
|
||||||
This section describes setting up basic application roles for Grafana within the Azure Portal. For more information, see [Add app roles to your application and receive them in the token](https://learn.microsoft.com/en-us/entra/identity-platform/howto-add-app-roles-in-apps).
|
This section describes setting up basic application roles for Grafana within the Azure Portal. For more information, see [Add app roles to your application and receive them in the token](https://learn.microsoft.com/en-us/entra/identity-platform/howto-add-app-roles-in-apps).
|
||||||
|
|
@ -437,3 +445,37 @@ See [Configure Grafana]({{< relref "../../../configure-grafana#authazuread" >}})
|
||||||
# prevents the sync of org roles from AzureAD
|
# prevents the sync of org roles from AzureAD
|
||||||
skip_org_role_sync = true
|
skip_org_role_sync = true
|
||||||
```
|
```
|
||||||
|
|
||||||
|
## Configuration options
|
||||||
|
|
||||||
|
The following table outlines the various Azure AD/Entra ID configuration options. You can apply these options as environment variables, similar to any other configuration within Grafana. For more information, refer to [Override configuration with environment variables]({{< relref "../../../configure-grafana#override-configuration-with-environment-variables" >}}).
|
||||||
|
|
||||||
|
| Setting | Required | Supported on Cloud | Description | Default |
|
||||||
|
| ---------------------------- | -------- | ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------- |
|
||||||
|
| `enabled` | No | Yes | Enables Azure AD/Entra ID authentication. | `false` |
|
||||||
|
| `name` | No | Yes | Name that refers to the Azure AD/Entra ID authentication from the Grafana user interface. | `OAuth` |
|
||||||
|
| `icon` | No | Yes | Icon used for the Azure AD/Entra ID authentication in the Grafana user interface. | `signin` |
|
||||||
|
| `client_id` | Yes | Yes | Client ID of the App (`Application (client) ID` on the **App registration** dashboard). | |
|
||||||
|
| `client_secret` | Yes | Yes | Client secret of the App. | |
|
||||||
|
| `auth_url` | Yes | Yes | Authorization endpoint of the Azure AD/Entra ID OAuth2 provider. | |
|
||||||
|
| `token_url` | Yes | Yes | Endpoint used to obtain the OAuth2 access token. | |
|
||||||
|
| `auth_style` | No | Yes | Name of the [OAuth2 AuthStyle](https://pkg.go.dev/golang.org/x/oauth2#AuthStyle) to be used when ID token is requested from OAuth2 provider. It determines how `client_id` and `client_secret` are sent to Oauth2 provider. Available values are `AutoDetect`, `InParams` and `InHeader`. | `AutoDetect` |
|
||||||
|
| `scopes` | No | Yes | List of comma- or space-separated OAuth2 scopes. | `openid email profile` |
|
||||||
|
| `allow_sign_up` | No | Yes | Controls Grafana user creation through the Azure AD/Entra ID login. Only existing Grafana users can log in with generic OAuth if set to `false`. | `true` |
|
||||||
|
| `auto_login` | No | Yes | Set to `true` to enable users to bypass the login screen and automatically log in. This setting is ignored if you configure multiple auth providers to use auto-login. | `false` |
|
||||||
|
| `role_attribute_strict` | No | Yes | Set to `true` to deny user login if the Grafana org role cannot be extracted using `role_attribute_path` or `org_mapping`. For more information on user role mapping, refer to [Map roles]({{< relref "#map-roles" >}}). | `false` |
|
||||||
|
| `org_attribute_path` | No | No | [JMESPath](http://jmespath.org/examples.html) expression to use for Grafana org to role lookup. Grafana will first evaluate the expression using the OAuth2 ID token. If no value is returned, the expression will be evaluated using the user information obtained from the UserInfo endpoint. The result of the evaluation will be mapped to org roles based on `org_mapping`. For more information on org to role mapping, refer to [Org roles mapping example](#org-roles-mapping-example). | |
|
||||||
|
| `org_mapping` | No | No | List of comma- or space-separated `<ExternalOrgName>:<OrgIdOrName>:<Role>` mappings. Value can be `*` meaning "All users". Role is optional and can have the following values: `None`, `Viewer`, `Editor` or `Admin`. For more information on external organization to role mapping, refer to [Org roles mapping example](#org-roles-mapping-example). | |
|
||||||
|
| `allow_assign_grafana_admin` | No | No | Set to `true` to automatically sync the Grafana server administrator role. When enabled, if the Azure AD/Entra ID user's App role is `GrafanaAdmin`, Grafana grants the user server administrator privileges and the organization administrator role. If disabled, the user will only receive the organization administrator role. For more details on user role mapping, refer to [Map roles]({{< relref "#map-roles" >}}). | `false` |
|
||||||
|
| `skip_org_role_sync` | No | Yes | Set to `true` to stop automatically syncing user roles. This will allow you to set organization roles for your users from within Grafana manually. | `false` |
|
||||||
|
| `allowed_groups` | No | Yes | List of comma- or space-separated groups. The user should be a member of at least one group to log in. If you configure `allowed_groups`, you must also configure Azure AD/Entra ID to include the `groups` claim following [Configure group membership claims on the Azure Portal]({{< relref "#configure-group-membership-claims-on-the-azure-portal" >}}). | |
|
||||||
|
| `allowed_organizations` | No | Yes | List of comma- or space-separated Azure tenant identifiers. The user should be a member of at least one tenant to log in. | |
|
||||||
|
| `allowed_domains` | No | Yes | List comma- or space-separated domains. The user should belong to at least one domain to log in. | |
|
||||||
|
| `tls_skip_verify_insecure` | No | No | If set to `true`, the client accepts any certificate presented by the server and any host name in that certificate. _You should only use this for testing_, because this mode leaves SSL/TLS susceptible to man-in-the-middle attacks. | `false` |
|
||||||
|
| `tls_client_cert` | No | No | The path to the certificate. | |
|
||||||
|
| `tls_client_key` | No | No | The path to the key. | |
|
||||||
|
| `tls_client_ca` | No | No | The path to the trusted certificate authority list. | |
|
||||||
|
| `use_pkce` | No | Yes | Set to `true` to use [Proof Key for Code Exchange (PKCE)](https://datatracker.ietf.org/doc/html/rfc7636). Grafana uses the SHA256 based `S256` challenge method and a 128 bytes (base64url encoded) code verifier. | `true` |
|
||||||
|
| `use_refresh_token` | No | Yes | Enables the use of refresh tokens and checks for access token expiration. When enabled, Grafana automatically adds the `offline_access` scope to the list of scopes. | `true` |
|
||||||
|
| `force_use_graph_api` | No | Yes | Set to `true` to always fetch groups from the Microsoft Graph API instead of the `id_token`. If a user belongs to more than 200 groups, the Microsoft Graph API will be used to retrieve the groups regardless of this setting. | `false` |
|
||||||
|
| `signout_redirect_url` | No | Yes | URL to redirect to after the user logs out. | |
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue