https://docs.goauthentik.io/integrations/services/grafana/
new users with the "Grafana Admins" Group are still joining as Viewer.
#Grafana documentation for Group role mapping does not seem to work
flat fox
so it is recieveing the groups
but i think it uses the user info response for groups which wont have them, so it just defaults to viewer?
royal grotto
So when reading over the docs, do you have an authentik group named Grafana Admins? if not, you probably want to change that in the role_attribute_path variable. Maybe replace Grafana Admins with authentik Admins and change Grafana Editors to whatever group you want to be editors.
Based off this:
In the example shown above, one of the specified group names is "Grafana Admins". If the user is a member of this group, they will be granted the "Admin" role in Grafana. If the user is not a member of the "Grafana Admins" group, it moves on to see if the user is a member of the "Grafana Editors" group. If they are, they are granted the "Editor" role. Finally, if the user is not found to be a member of either of these groups, it fails back to granting the "Viewer" role.
I would assume that the roles Grafana Admins, and Grafana Editors would need to be groups inside Authentik since that is what Grafana is supposed to be verifing role assignment against.
flat fox
yes they are groups in authentik
flat fox
you can see they exist in this screenshot that has grafana debug logging
flat fox
So when reading over the docs, do you have an authentik group named Grafana Admi...
the docs unfortunately are leaving some critical info out, or are wrong / were correct at one point?
flat fox
regardless this is more useful than the authentik UI showing the groups exist as it means grafana *is * being sent the groups
also have tried using diffrent group names
tried the older docs where they add a new mapping for info.groups
royal grotto
I'm in the process of messing with this. So let me see what I can figure out and ill get back to you. Just not at my computer right now.
flat fox
also just checked its not something like GF_AUTH_GENERIC_OAUTH_ALLOW_ASSIGN_GRAFANA_ADMIN is getting ignored. cant assign as editor either on another account
at this point i want to see what the userinfo URL is actually returning because i suspect thats how grafana wants to get the groups but authentik is putting it in another request that it doesnt care about
looking at the keycloak documentation seems to suggest it wants groups in the ID token and userinfo
royal grotto
at this point i want to see what the userinfo URL is actually returning because ...
I got OAuth working fine with Groups workings as it should with Grafana. But a few things to note with my setup, I only use Authentik as my reverse proxy, no other middle man like traefik or npm, and I have the standalone version of Grafana installed, not the docker version.
at least in my standalone version in the config file, i had to have this set
#################################### Server ####################################
[server]
# Protocol (http, https, h2, socket)
protocol = http
protocol_https = https
# This is the minimum TLS version allowed. By default, this value is empty. Accepted values are: TLS1.2, TLS1.3. If nothing is set TLS1.2 would be taken
;min_tls_version = ""
# The ip address to bind to, empty will bind to all interfaces
http_addr = IP.ADDRESS.OF.GRAFANA
# The http port to use
http_port = 3000
# The public facing domain name used to access grafana from a browser
domain = grafana.domain.example
# Redirect to correct domain if host header does not match domain
# Prevents DNS rebinding attacks
;enforce_domain = true
# The full public facing url you use in browser, used for redirects and emails
# If you use reverse proxy and sub path specify full url (with sub path)
root_url = %(protocol)s://%(http_addr)s:%(http_port)s/
root_url = %(protocol_https)s://%(domain)s/
Then for the OAuth Settings I have this:
[auth]
signout_redirect_url = https://auth.domain.example/application/o/OAUTH-SLUG/end-session/
# Optionally enable auto-login
oauth_auto_login = false
[auth.generic_oauth]
name = authentik
enabled = true
client_id = REDACTED
client_secret = REDACTED
scopes = openid email profile
auth_url = https://auth.domain.example/application/o/authorize/
token_url = https://auth.domain.example/application/o/token/
api_url = https://auth.domain.example/application/o/userinfo/
# Optionally map user groups to Grafana roles
role_attribute_path = contains(groups, 'authentik Admins') && 'Admin' || contains(groups, 'Grafana Editors') && 'Editor' || 'Viewer'
I even tested this with 2 other accounts. An editor gets put into editor and viewer gets put into viewer
flat fox
mind sharing a redacted debug log?
mostly gonna be the logs between "Extracting user info from OAuth token" & "User info result"
royal grotto
Yea im a bit busy for the next few hours but ill get it as soon as I can
flat fox
all good thanks. hopfully that gives some idea of whats going wrong
royal grotto
all good thanks. hopfully that gives some idea of whats going wrong
This is all I have in my Log file for Grafana after logging in with the OAuth Button.
Everything else is logger=plugins, logger=cleanup, or logger=infra
I get the same thing when logging in for a second time.
flat fox
ah you might need to set your log level to debug to get the logs i got as that will include the data you get back from the requests
thanks for your help
#################################### Logging ##########################
[log]
# Either "console", "file", "syslog". Default is console and file
# Use space to separate multiple modes, e.g. "console file"
mode = console file
# Either "debug", "info", "warn", "error", "critical", default is "info"
level = debug
or env variable should be GF_LOG_LEVEL
royal grotto
Oh oops. I thought i had in debug. But let me check again. My bad.
Here this looks better. lol Hopefully I redacted all personal info. lol
flat fox
ah looks like has some logic to cache some of the login so you dont have the logger=oauth.generic_oauth t=2024-04-16T22:39:52.312118394Z level=debug msg="Getting user info" etc requests
royal grotto
I can send the whole debug file if needed but that will take a little more time to go through and redact info. I copied about half of the file currently. At least where I saw oauth start.
flat fox
looking more into this i suspect its gonna be JMESPath being real funny about how the request looks
just playing about with it in cli and it gets very funny about matching certian cases
royal grotto
Hopefully my logs helped. I dont think I did anything special. Just followed the docs from Authentik and changed appropriate groups. The only major thing I changed was grafana config to have 2 root urls. One points to internal ip and the other to external fqdn.
flat fox
seems grafana decided to reinvent the wheel with configs. whatever they are doing means my config is being overriden by some omnipotent god
royal grotto
The only difference is that I noticed is the type of install for Grafana we are using.
flat fox
i tried changing my sso settings in the config file and they get overriden by somewhere else likely their UI settings override it as i originally applied them there
flat fox
fantastic i have it working
basically setting the SSO in the webUI writes it to what i can only assume is the internal DB for some insane reason i dont understand
overriding the config and env variables
because thats sane and very normal
maybe i expect too much for a company that replaced their docs search with an AI agent