authentik/website/integrations/services/grafana/index.mdx

---
title: Grafana
---

<span class="badge badge--primary">Support level: authentik</span>

## What is Grafana

> Grafana is a multi-platform open source analytics and interactive visualization web application. It provides charts, graphs, and alerts for the web when connected to supported data sources, Grafana Enterprise version with additional capabilities is also available. It is expandable through a plug-in system.
>
> -- https://en.wikipedia.org/wiki/Grafana

## Preparation

The following placeholders will be used:

-   `grafana.company` is the FQDN of the Grafana install.
-   `authentik.company` is the FQDN of the authentik install.

Create an application in authentik. Create an OAuth2/OpenID provider with the following parameters:

-   Client Type: `Confidential`
-   Scopes: OpenID, Email and Profile
-   Signing Key: Select any available key
-   Redirect URIs: `https://grafana.company/login/generic_oauth`

Additionally, because Grafana has its own concept of groups, we need to create a custom Scope Mapping to ensure Grafana can read the user's groups assigned within authentik. It should contain the following expression:

```json
return {
  "info": { "groups": [group.name for group in request.user.ak_groups.all()] },
}
```

This ensures that groups are available under `info.groups[]`, which can be used later in [Role Mapping](#role-mappings).

Note the Client ID and Client Secret values. Create an application, using the provider you've created above. Note the slug of the application you've created.

## Terraform provider

```hcl

data "authentik_flow" "default-provider-authorization-implicit-consent" {
  slug = "default-provider-authorization-implicit-consent"
}

data "authentik_scope_mapping" "scope-email" {
  name = "authentik default OAuth Mapping: OpenID 'email'"
}

data "authentik_scope_mapping" "scope-profile" {
  name = "authentik default OAuth Mapping: OpenID 'profile'"
}

data "authentik_scope_mapping" "scope-openid" {
  name = "authentik default OAuth Mapping: OpenID 'openid'"
}

resource "authentik_scope_mapping" "scope-grafana-roles" {
  name = "Grafana Groups"
  scope_name = "grafana-groups"
  expression = <<EOF
return {
  "info": { "groups": [group.name for group in request.user.ak_groups.all()] },
}
EOF
}

resource "authentik_provider_oauth2" "grafana" {
  name          = "Grafana"
  #  Required. You can use the output of:
  #     $ openssl rand -hex 16
  client_id     = "my_client_id"

  # Optional: will be generated if not provided
  # client_secret = "my_client_secret"

  authorization_flow  = data.authentik_flow.default-provider-authorization-implicit-consent.id

  redirect_uris = ["https://grafana.company/login/generic_oauth"]

  property_mappings = [
    data.authentik_scope_mapping.scope-email.id,
    data.authentik_scope_mapping.scope-profile.id,
    data.authentik_scope_mapping.scope-openid.id,
    authentik_scope_mapping.scope-grafana-roles.id,
  ]
}

resource "authentik_application" "grafana" {
  name              = "Grafana"
  slug              = "grafana"
  protocol_provider = authentik_provider_oauth2.grafana.id
}

resource "authentik_group" "grafana_admins" {
  name    = "Grafana Admins"
}

resource "authentik_group" "grafana_editors" {
  name    = "Grafana Editors"
}

resource "authentik_group" "grafana_viewers" {
  name    = "Grafana Viewers"
}

```

## Grafana configuration

import Tabs from "@theme/Tabs";
import TabItem from "@theme/TabItem";

<Tabs
  defaultValue="docker"
  values={[
    {label: 'Docker', value: 'docker'},
    {label: 'Standalone', value: 'standalone'},
    {label: 'Helm', value: 'helm'},
  ]}>
  <TabItem value="docker">
If your Grafana instance is running in Docker, set the following environment variables:

```yaml
environment:
    GF_AUTH_GENERIC_OAUTH_ENABLED: "true"
    GF_AUTH_GENERIC_OAUTH_NAME: "authentik"
    GF_AUTH_GENERIC_OAUTH_CLIENT_ID: "<Client ID from above>"
    GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: "<Client Secret from above>"
    GF_AUTH_GENERIC_OAUTH_SCOPES: "openid profile email"
    GF_AUTH_GENERIC_OAUTH_AUTH_URL: "https://authentik.company/application/o/authorize/"
    GF_AUTH_GENERIC_OAUTH_TOKEN_URL: "https://authentik.company/application/o/token/"
    GF_AUTH_GENERIC_OAUTH_API_URL: "https://authentik.company/application/o/userinfo/"
    GF_AUTH_SIGNOUT_REDIRECT_URL: "https://authentik.company/application/o/<Slug of the application from above>/end-session/"
    # Optionally enable auto-login (bypasses Grafana login screen)
    GF_AUTH_OAUTH_AUTO_LOGIN: "true"
    # Optionally map user groups to Grafana roles
    GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH: "contains(info.groups[*], 'Grafana Admins') && 'Admin' || contains(info.groups[*], 'Grafana Editors') && 'Editor' || 'Viewer'"
```

  </TabItem>
  <TabItem value="standalone">
If you are using a config-file instead, you have to set these options:

```ini
[auth]
signout_redirect_url = https://authentik.company/application/o/<Slug of the application from above>/end-session/
# Optionally enable auto-login
oauth_auto_login = true

[auth.generic_oauth]
name = authentik
enabled = true
client_id = <Client ID from above>
client_secret = <Client Secret from above>
scopes = openid email profile
auth_url = https://authentik.company/application/o/authorize/
token_url = https://authentik.company/application/o/token/
api_url = https://authentik.company/application/o/userinfo/
# Optionally map user groups to Grafana roles
role_attribute_path = contains(info.groups[*], 'Grafana Admins') && 'Admin' || contains(info.groups[*], 'Grafana Editors') && 'Editor' || 'Viewer'
```

  </TabItem>
  <TabItem value="helm">
If you are using a Helm `values.yaml` file instead, you have to set these options:

```yaml
grafana.ini:
    auth:
        signout_redirect_url: "https://authentik.company/application/o/<Slug of the application from above>/end-session/"
        oauth_auto_login: true
    auth.generic_oauth:
        name: authentik
        enabled: true
        client_id: "<Client ID from above>"
        client_secret: "<Client Secret from above>"
        scopes: "openid profile email"
        auth_url: "https://authentik.company/application/o/authorize/"
        token_url: "https://authentik.company/application/o/token/"
        api_url: "https://authentik.company/application/o/userinfo/"
        # Optionally map user groups to Grafana roles
        role_attribute_path: contains(info.groups[*], 'Grafana Admins') && 'Admin' || contains(info.groups[*], 'Grafana Editors') && 'Editor' || 'Viewer'
```

:::note
For security reasons you shouldn't inline the client_secret in the values, but use a secret instead. For more information, see https://github.com/grafana/helm-charts/blob/main/charts/grafana/README.md#how-to-securely-reference-secrets-in-grafanaini
:::

  </TabItem>
</Tabs>

### Role Mappings

In the configuration above you can see an example of a role mapping. Upon login, this configuration looks at the groups of which the current user is a member. If any of the specified group names are found, the user will be granted the resulting role in Grafana.

In the example shown above, one of the specified group names is "Grafana Admins". If the user is a member of this group, they will be granted the "Admin" role in Grafana.
If the user is not a member of the "Grafana Admins" group, it moves on to see if the user is a member of the "Grafana Editors" group. If they are, they are granted the "Editor" role. Finally, if the user is not found to be a member of either of these groups, it fails back to granting the "Viewer" role.

```text
contains(info.groups[*], 'Grafana Admins') && 'Admin' || contains(info.groups[*], 'Grafana Editors') && 'Editor' || 'Viewer'
         ^ attribute     ^ group to search for^ role to grant                                                       ^ or grant "Viewer" role.
```

For more information on group/role mappings, see [Grafana's docs](https://grafana.com/docs/grafana/latest/auth/generic-oauth/#role-mapping).

### Grafana Configuration Considerations

Make sure in your configuration that `root_url` is set correctly, otherwise your redirect url might get processed incorrectly. For example, if your grafana instance is running on the default configuration and is accessible behind a reverse proxy at `https://grafana.company`, your redirect url will end up looking like this, `https://grafana.company/`.
If you get `user does not belong to org` error when trying to log into grafana for the first time via OAuth, check if you have an organization with the ID of `1`, if not, then you have to add the following to your grafana config:

```ini
[users]
auto_assign_org = true
auto_assign_org_id = <id-of-your-default-organization>
```