311 Commits

Author SHA1 Message Date
c94f930950 Update dependency prettier to v3.6.2 (#108689)
* Update dependency prettier to v3.6.2

* run prettier

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Ashley Harrison <ashley.harrison@grafana.com>
2025-07-25 17:47:44 +01:00
69d3b9023c SCIM Docs: Add mapping in AzureAD for the active attribute (#108669)
add mapping in AzureAD for the active attribute
2025-07-25 18:27:15 +03:00
eeb44c1d63 Docs: Remove LDAP debug view section (#108214)
remove LDAP debug view section from docs
2025-07-22 12:32:24 +03:00
0cb6e3fe93 Docs: Add custom fields to Azure/Entra Terraform example (#108222)
Add custom fields to Azure/Entra TF example
2025-07-18 13:00:31 +02:00
8dfb4cdfc9 SSO: Add prompt param to SSO settings (#107969)
* add prompt param to AzureAD oauth config

* yarn i18n-extract

* validate auth prompt value

* make login_prompt available for all SSO providers

* use base authCodeURL for azure and google

* add docs for the new field for azure and generic oauth

* fix typo

* fix frontend unit test

* add prompt parameter to docs for the other providers

* remove prompt from okta

* add unit tests for the other providers

* address feedback

* add back translations for prompt labels
2025-07-17 14:40:48 +03:00
807264428e SAML: Revert SAML assertion default names in documentation (#108212)
Revert SAML assertion default names in documentation
2025-07-17 13:11:48 +02:00
a94647d5cc Auth: Remove ssoSettingsSAML feature toggle (#108109)
* Remove ssoSettingsSAML feature toggle

* Remove from docs + align tests

* Update workspace

* revert go.mod go.sum change

* make update-workspace without enterprise linked
2025-07-16 21:13:31 +02:00
032ea5d5b8 Update SAML configuration options (#108178) 2025-07-16 20:39:28 +02:00
91a54d0e0e SCIM: doc upgrades (#108098)
* Add public preview warning

* Add migration strategy

* Add troubleshooting guide

* Improve description

* Improve docs

* Add versbosity

* Addresss PR comments
2025-07-16 20:39:09 +02:00
92d098fdfd Auth: Make domain_hint configurable for the Azure AD/Entra ID connector (#108061)
* Make domain_hint configurable for Entra ID/Azure AD

* Add docs

* Fix + i18n gen

* Add validation to domain hint

* Remove unnecessary change
2025-07-15 12:53:19 +02:00
c20067d70a docs: Clarifying the support level of SCIM (#108034) 2025-07-11 12:53:34 -05:00
39d7fbd66e Docs: Updating team sync admonition wording (#107990) 2025-07-11 07:25:43 -05:00
1d252de1e9 Docs: Clean up ssoSettingsApi references from docs (#107896)
* Clean up ssoSettingsApi references from docs

* lint
2025-07-09 14:22:07 +00:00
Jo
1e1fd3db38 OAuth: Add access token as third source for user info extraction (#107636)
* Add access token as third source for user info extraction

- Add extractFromAccessToken method to extract user info from JWT access tokens
- Mutualize code by creating parseUserInfoFromJSON helper method
- Rename methods for clarity: extractFromToken -> extractFromIDToken, retrieveRawIDToken -> retrieveRawJWTPayload
- Update test suite to include comprehensive access token retrieval scenarios
- Support three sources in priority order: ID token, API response, access token
- Maintain backward compatibility while adding new functionality

* Update Generic OAuth documentation to reflect access token support

- Add access token as a third source for user information extraction
- Update configuration sections to mention access tokens alongside ID tokens and UserInfo endpoint
- Document the priority order: ID token → UserInfo endpoint → access token
- Update configuration option descriptions to reflect new functionality
- Maintain consistency with implementation changes

* Refactor access token test cases to use parameter instead of hardcoded logic

- Add AccessToken field to test case struct for explicit access token specification
- Remove hardcoded string matching logic that determined access token based on test name
- Update all access token test cases to include the AccessToken field with appropriate JWT values
- Improve test maintainability and clarity by making access tokens explicit parameters
- Remove unused strings import that was only needed for the hardcoded logic

* fix doc lint

* reduce cyclomatic complexity
2025-07-08 15:38:11 +02:00
6c2574848f Docs: Updating team sync availability (#107721) 2025-07-07 16:07:50 -05:00
8760d280f7 Docs: Fix links from supported providers in team sync page (#107468)
fix links from supported providers to team sync
2025-07-02 10:02:53 +03:00
dbef739814 SCIM: Update authentication features table (#107299)
* Update authentication features table
2025-06-27 16:58:29 +02:00
694a58372e Config: Fix docs typo'd section name (#106982) 2025-06-25 08:04:32 +02:00
244ffad99d Fix all the old usage of admonition syntax (#106984) 2025-06-19 17:31:13 +01:00
96f1582c36 Docs: Remove api key references from docs (#106134)
remove api key references from docs
2025-06-17 18:20:08 +03:00
3f2d2ec38c SAML catalog: Set default values for SAML assertion - docs (#106773)
Update documnetation references
2025-06-16 17:50:29 +02:00
ed1da3456c Docs: Remove public preview card from cloud migration audit logging section (#106472) 2025-06-10 15:00:25 +02:00
9717d04039 SCIM: Add IDP specific SAML configuration (#106327)
* Add assertion_attrbiute_external_uid definition

* Add Okta specific configuration

* Add Azure AD configuration

* Expand definition and reference idp specific configuration
2025-06-05 10:50:28 +02:00
a09df33522 [docs] Update broken links in SCIM provisioning documentation (#106298)
Update broken links

Signed-off-by: Tiffany Hrabusa <tiffany.hrabusa@grafana.com>
2025-06-03 12:51:39 -07:00
fc988c8771 Auth: Add Azure/Entra workload identity support (#104807)
* fixes/adds azure workload identity authentication. Issue #78249

* Updates default values. Adds `workload_identity_token_file` defaults

* Updates example config. Adds `workload_identity_token_file`

* Updates docummentation: adds Federated credentials for Workload Identity

* Update docs/sources/setup-grafana/configure-security/configure-authentication/azuread/index.md

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>

* Update docs/sources/setup-grafana/configure-security/configure-authentication/azuread/index.md

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>

* Docs: add link to official documentation. Clarifies example.

* 1. Add workload_identity_enabled and workload_identity_token_file settings to [auth.azuread] for workload identity support.

2. Extend OAuthInfo struct to include workload identity fields.
3. Update OAuth authentication logic to handle Azure AD workload identity using federated token as client assertion.
4. Update sample configuration and documentation for new settings.

* ensure environment variable overrides are respected for OAuth SSO settings

- Ensure that settings loaded in pkg/services/ssosettings/strategies/oauth_strategy.go correctly reflect environment variable overrides, matching Grafana's config behavior.
- Align config loading logic with main config loader to prevent issues where INI values would override environment variables.

* updates documentation

* test: add workload identity configuration tests for Azure AD OAuth strategy. Add test coverage for workload_identity_enabled and workload_identity_token_file settings

* feat: add workload identity support to Azure AD SSO configuration UI

* updates documentation

* Simplify OAuth flow by removing unnecessary switch-case structure

* Small changes

* Lint + i18n gen

* refactor: remove redundant workload_identity_enabled setting as auth method gets defined by client_authentication

* update documentation

* refactor: remove redundant workload_identity_enabled setting as auth method gets defined by client_authentication

* updates documentation - configuration options table: adds `client_authentication`, `workload_identity_token_file`, and `federated_credential_audience`

* Small changes, lint, i18n

---------

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>
2025-05-29 14:09:18 +02:00
e572af4562 docs: fix keycloak signout_redirect_url (#106191) 2025-05-29 07:00:50 +00:00
959ccb8ec2 Docs: Adding info on configuring CORS via reverse proxy (#104203)
* Docs: Adding info on configuring cors via reverse proxy

* Adding info regarding grafana.ini CORS configuration

* some clarification and typo fixes

* expanding the instructions

* run prettier

* fixing indentation

* adjusting an admonition

* adjusting information based on review
2025-05-28 08:18:21 -05:00
8734b54f90 Docs: document required return type for org_attribute_path (#105946)
Co-authored-by: linoman <2051016+linoman@users.noreply.github.com>
Co-authored-by: Irene Rodríguez <irene.rodriguez@grafana.com>
2025-05-23 13:48:10 +00:00
fa98a96e5d Fix broken links (#105936) 2025-05-23 13:11:27 +00:00
fbf87a9fc1 Docs: Fix SCIM availability note about Grafana Cloud (#105649)
* Docs: Fix SCIM availability note about Grafana Cloud

* SCIM and Team Sync are available in Pro
2025-05-20 17:11:57 +02:00
1099422050 Docs: Update the page on configuring SCIM with AzureAD (#105477)
* update the docs on configuring SCIM with AzureAD

* run prettier

* fix note block

* fix typo
2025-05-16 10:02:22 +03:00
39e7804557 Add comments explaining what pages the aliases redirect and fix broken aliases (#105408) 2025-05-14 19:45:35 +03:00
039b1765a0 Docs: Update the guide on how to configure SCIM with okta (#105377)
* update docs on how to configure SCIM with okta

* fix enterprise link

* add introductory paragraph under "Configure provisioning settings"

This paragraph has been added to avoid stacked headings that break the flow of the documentation and hurt SEO

* split SCIM connector base URL config for cloud and onprem

---------

Co-authored-by: Irene Rodríguez <irene.rodriguez@grafana.com>
2025-05-14 16:13:49 +03:00
ed4680495a fix broken links (#105343) 2025-05-14 10:06:31 +02:00
d05b2862b6 SCIM: update docs with externalId field & correct endpoint (#105026)
* SCIM: update docs with externalId field

* better phrasing

* vale warning fix

* explain where mapping is configured

* clarify assertion_attribute_login

* better phrasing

* even better explanation

* remove confusing step

* remove confusing line

* linter fixes

* improve Integrating with SCIM Provisioning section

* bigger warning about scim/saml unique identifier mismatch

* lint

* vale fixes

* Add Integrating with SCIM Provisioning part

---------

Co-authored-by: Vardan Torosyan <vardants@gmail.com>
2025-05-07 09:45:11 -04:00
08d7e75b5c Docs: SAML docs refactoring (#103450)
* Docs: SAML docs refactoring

* Cleanup the root page

* Update the root file

* Refactor Azure AD guide

* Change the order of the tree

* Remove the index file again, back from main

* SAML UI page review and editing

* Review and edit SAML config options page

* SAML signing and encryption edit/review

* Remaining pages and aliases

* Fix PR comments

* More fixes

* Update _index.md

* Update _index.md

* Update _index.md

* Apply suggestions from code review

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>

* Handle PR comments

---------

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>
2025-05-07 10:07:57 +02:00
2a6736aae3 Docs: Clarify how authNZ works when SCIM is enabled (#103857)
* Docs: Clarify how authNZ works when SCIM is enabled

* Use Grafana Cloud instead of grafana.com
2025-04-11 13:54:52 +00:00
8dfb0874a0 Docs: removing docs debt in install docs (#101750)
* Docs: removing docs debt in install docs

* cleaning up set up docs debt

* fixing some vale errors

* fixing broken admonition shortcode

* fixing broken shortcode

* fixing broken shortcode

* working to the grafana authentication config

* updating some more files

* editing down to ldap in the repo

* editing ldap doc except final section with link needed

* Finishing doc debt cleanup through configure authetication

* fixing shortcodes reverted by merge conflict fix

* fixing admonition

* fixing more broken shortcodes

* adjusting some wordings ot make vale happy

* updating feature toggle info
2025-04-09 09:02:51 -05:00
6901e21700 Docs: Grafana SCIM provisioning overview (#102183)
* Docs: Create a landing page for SCIM provisioning

* Fix docs warnings

* Update docs/sources/setup-grafana/configure-security/configure-scim-provisioning/_index.md

Co-authored-by: Jack Baldry <jack.baldry@grafana.com>

* Update docs/sources/setup-grafana/configure-security/configure-scim-provisioning/_index.md

Co-authored-by: Jack Baldry <jack.baldry@grafana.com>

* Apply suggestions from code review

Co-authored-by: Jack Baldry <jack.baldry@grafana.com>

* Address some of the feedback and simplify few parts

* Remove repetitive wording

* Don't use possessive form, again

* Address the feedback from PR

* Docs: Manage users and teams via SCIM (#102478)

* Docs: Manage users and teams via SCIM

* Docs: Manage users and teams via SCIM

* Refactor managing users parts

* Add team sync docs

* Update _index.md

* Apply suggestions from code review

Co-authored-by: linoman <2051016+linoman@users.noreply.github.com>

* Clarify how user identity linking is working

* Fix formatting

* Docs: Configure SCIM with Azure and Okta (#102582)

* Docs: Configure SCIM with Azure and Okta

* Apply suggestions from code review

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>

---------

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>

---------

Co-authored-by: linoman <2051016+linoman@users.noreply.github.com>
Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>

* Add a warning about migration from team sync

* Remove the SAML setup instructions from SCIM docs

* Update _index.md

* Update _index.md

* Apply suggestions from code review

Co-authored-by: Jack Baldry <jack.baldry@grafana.com>
Co-authored-by: Sarah Constant <sarahleejane@users.noreply.github.com>

* Address PR feedback

* Stop using possessive form

* Add a note mentioning that users/teams can not be manually deleted

* Update _index.md

* Docs: SCIM configuration options (#103085)

* Add a section to clarify how SCIM works with other IdPs

* Update _index.md

* Update _index.md

---------

Co-authored-by: Jack Baldry <jack.baldry@grafana.com>
Co-authored-by: linoman <2051016+linoman@users.noreply.github.com>
Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>
Co-authored-by: Sarah Constant <sarahleejane@users.noreply.github.com>
2025-04-02 16:55:54 +02:00
180f579f18 Revert "Anonymous: Enforce org role Viewer setting (#102070)" (#103043)
This reverts commit e216c2f29dcc5d2c2b396c26e5f07437566a3359.
2025-03-31 10:31:53 +01:00
73e0db452b Docs: Add a section to clarify how sessions are handled with SSO (#102694)
* Docs: Add a section to clarify how sessions are handled with SSO

* Add a link to SAML SLO setup
2025-03-27 16:40:57 +01:00
e216c2f29d Anonymous: Enforce org role Viewer setting (#102070)
* Anon: Remove org role setting

* remove from ini

* remove setting from documentation
2025-03-27 09:10:30 +00:00
7d435e5d84 Docs: Cleaning up configure security hardening docs (#102567)
* Docs: Cleaning up configure security hardening docs

* Adjusting layout
2025-03-21 11:16:10 -05:00
8af271187c Docs: Remove references to group sync (#102599)
* remove references to group sync

* remove relfref and add new link

* remove relfref

* Update relfref

* remove relrefs and add admonitions

* fix URL

* remove relrefs

* replace relrefs

* replace relrefs

* replace relrefs

* replace relrefs

* replace relrefs

* replace relrefs

* replace relrefs

* replace relrefs

* run prettier

---------

Co-authored-by: Irene Rodríguez <irene.rodriguez@grafana.com>
2025-03-21 16:13:44 +00:00
874751d9da Docs: AzureAD + SAML improvements (#102623)
* Docs: AzureAD + SAML improvements

* Fix
2025-03-21 17:00:12 +01:00
aeca9a80a4 JWT: Add org role mapping support to the JWT provider (#101584)
* add org role mapping to the jwt provider

* Fix indentation for OrgMapping assignment

* add-test

* fix linting

* add org_attribute_path

* fix test

* update doc

* update doc

* Update pkg/services/authn/clients/jwt.go

* Update docs

---------

Co-authored-by: Mihaly Gyongyosi <mgyongyosi@users.noreply.github.com>
2025-03-21 14:18:53 +01:00
1e0d7102cc Docs: Add auth for metrics to hardening page (#102475) 2025-03-20 14:22:54 +01:00
afb058c40a Fix URL rendering typo (#102346)
* Fix URL rendering typo

* run prettier

---------

Co-authored-by: Irene Rodriguez <irene.rodriguez@grafana.com>
2025-03-18 11:42:25 +01:00
cf60c4e77f Update SAML configuration steps (#101663)
* replace relrefs and minor edits

* add new content and links

* Update docs/sources/setup-grafana/configure-security/configure-authentication/saml/index.md

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>

* Update docs/sources/setup-grafana/configure-security/configure-authentication/saml/index.md

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>

* changes from linter and content suggestions

* Update docs/sources/setup-grafana/configure-security/configure-authentication/saml/index.md

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>

* Update docs/sources/setup-grafana/configure-security/configure-authentication/saml/index.md

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>

* Update docs/sources/setup-grafana/configure-security/configure-authentication/saml/index.md

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>

* Update docs/sources/setup-grafana/configure-security/configure-authentication/saml/index.md

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>

* run prettier

---------

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>
Co-authored-by: Irene Rodriguez <irene.rodriguez@grafana.com>
2025-03-10 13:04:27 +00:00
ff10186db7 Docs: Group Attribute Sync feature in private preview (#101822)
* Docs: Group Attribute Sync feature in private preview

* add link & support note

* update GAS API docs
2025-03-07 14:28:26 -05:00