Migrating Grafana Users To Authentik

Overview

Authentik

Log in as admin and go to the admin interface.

From the menu go to Applications > Applications. Go through the Create With Wizard to setup a new application and provider.

Enter a name and slug. Slug will be used in the URL so change this if you do not want it to show up / shared with Grafana.

Select Oauth2/OIDC for the provider type.

Give the provider a name or edit the name given and the authentication flow should be explict. Leave the rest as the default.

Grafana

Follow the guide again.

I’m using Docker so used all of these environment variables:
environment:
GF_AUTH_GENERIC_OAUTH_ENABLED: "true"
GF_AUTH_GENERIC_OAUTH_NAME: "authentik"
GF_AUTH_GENERIC_OAUTH_CLIENT_ID: ""
GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: ""
GF_AUTH_GENERIC_OAUTH_SCOPES: "openid profile email"
GF_AUTH_GENERIC_OAUTH_AUTH_URL: "https://authentik.company/application/o/authorize/"
GF_AUTH_GENERIC_OAUTH_TOKEN_URL: "https://authentik.company/application/o/token/"
GF_AUTH_GENERIC_OAUTH_API_URL: "https://authentik.company/application/o/userinfo/"
GF_AUTH_SIGNOUT_REDIRECT_URL: "https://authentik.company/application/o//end-session/"

Add the following variable:
GF_AUTH_OAUTH_ALLOW_INSECURE_EMAIL_LOOKUP: "true"

This will allow existing users to log in via Authentik and and avoid the error where the user already exists. Get all existing users to log into their accounts. Once that is done, either remove the environment variable or set it to false:
GF_AUTH_OAUTH_ALLOW_INSECURE_EMAIL_LOOKUP: "false"

A new login button appears at the bottom to use Authentik.

Summary

The road to centralised identity management is going well and I’m surprised how many products support the ability to do this.

About Danny

I.T software professional always studying and applying the knowledge gained and one way of doing this is to blog. Danny also has participates in a part time project called Energy@Home [http://code.google.com/p/energyathome/] for monitoring energy usage on a premise. Dedicated to I.T since studying pure Information Technology since the age of 16, Danny Tsang working in the field that he has aimed for since leaving school. View all posts by Danny → This entry was posted in Infrastructure, Security and tagged authentik, grafana, idp, oauth, oauth2.0, odic. Bookmark the permalink.

This site uses Akismet to reduce spam. Learn how your comment data is processed.