opensource/grafana
1
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-08-02 07:32:13 +08:00
Code Issues Packages Projects Releases Wiki Activity

Docs: fix authsaml to security (#50478)

Browse Source 
Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>
This commit is contained in:
Eric Leijonmarck
2022-06-09 10:11:12 +02:00
committed by GitHub
parent cddab15769
commit 52deb821d6
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
docs/sources/setup-grafana/configure-security/configure-authentication/saml.md
View File

@ -410,7 +410,7 @@ The keys you provide should look like:
### SAML login attempts fail with request response "origin not allowed"
When the user logs in using SAML and gets presented with "origin not allowed", the user might be issuing the login from an IdP (identity provider) service or the user is behind a reverse proxy. This potentially happens as Grafana's CSRF checks deem the requests to be invalid. For more information [CSRF](https://en.wikipedia.org/wiki/Cross-site_request_forgery).
When the user logs in using SAML and gets presented with "origin not allowed", the user might be issuing the login from an IdP (identity provider) service or the user is behind a reverse proxy. This potentially happens as Grafana's CSRF checks deem the requests to be invalid. For more information [CSRF](https://owasp.org/www-community/attacks/csrf).
To solve this issue, you can configure either the [`csrf_trusted_origins`]({{< relref "../../configure-grafana/enterprise-configuration/#csrf-trusted-origins" >}}) or [`csrf_origin_headers`]({{< relref "../../configure-grafana/enterprise-configuration/#csrf-origin-headers" >}}) option in the SAML configuration.
@ -419,7 +419,7 @@ Example of a configuration file:
```bash
# config.ini
...
[auth.saml]
[security]
csrf_trusted_origins = https://grafana.example.com
csrf_origin_headers = X-Forwarded-Proto X-Forwarded-Host X-Forwarded-Port
...