Grafana SSO with Microsoft Entra ID
Signing in to self-hosted Grafana with Microsoft Entra ID OAuth: app registration, app roles mapped to Grafana roles, allowed groups, multi-org mapping and what still needs Enterprise, such as team sync.
Grafana authentication and access control
Signing users in to self-hosted Grafana through enterprise identity providers and controlling what they can do, with the differences between open source and Enterprise editions.
Grafana SSO with Okta
Connecting Grafana to Okta with the Okta OAuth provider: group claims for role and org mapping, allowed groups, single logout, and the SCIM and team sync features that depend on the edition.
Grafana LDAP and Active Directory authentication
Configuring ldap.toml for Active Directory: bind account versus single bind, group mappings to org roles, nested groups, multiple domains, TLS settings and debugging failed logins with LDAP debug logging.
Grafana role and organization mapping with generic OAuth
Mapping identity provider claims to Grafana roles and organizations: JMESPath in role_attribute_path, org_mapping entries, strict role handling, granting server admin, and the email claim Grafana always needs.
Grafana login with GitLab or GitHub OAuth
Using GitLab or GitHub as the Grafana identity source for engineering teams: restricting sign-in to groups or organizations, mapping roles, and when to put a central identity provider in front instead.
Grafana behind an authenticating proxy such as OAuth2 Proxy
Letting a reverse proxy authenticate users and pass identity headers to Grafana: auth proxy settings, role mapping and enforce sync, header spoofing risks and locking Grafana so only the proxy can reach it.
Grafana JWT authentication for portals and embedded dashboards
Accepting signed JWTs from an existing application as Grafana logins: JWKS verification, required claims, auto sign-up, role and org mapping, and the lack of refresh token support.
Grafana service accounts and API tokens
Giving scripts, CI pipelines and provisioning tools access to Grafana: service accounts per organization, token expiry limits, the None role with minimal permissions, multiple tokens for rotation and auditing their use.
Grafana anonymous access: risks and licensing
When to let users view Grafana without logging in, such as wall displays: the organization and role anonymous users get, data exposure risks, Enterprise licensing of anonymous devices, and shared dashboards as an alternative.
