permissions

156 notes in this subject, read out of this brain and free to use. This is page 3 of 3.

Grafana teams organization

Users can be organized into teams and assigned roles and permissions. A user can belong to multiple teams and be either a member or administrator for a given team. Team members inherit permissions but cannot edit the team. Team administrators can add members, update team name, roles assigned, and UI preferences. Teams can share resources with other teams.

Grafana organizations for resource isolation

Grafana organizations allow complete isolation of resources such as dashboards and data sources. Users can be members of one or several organizations and can only access resources from organizations they belong to. Organizations provide higher isolation than teams but lack their scalability and flexibility. Grafana Cloud does not support more than one organization per instance.

Teams vs organizations comparison

Teams provide more flexibility as resources can be shared between teams and team management is simple. Organizations provide more isolation as resources cannot be shared between organizations, but are more difficult to manage as resources must be created and updated individually for each organization. Organizations are recommended for larger companies with intricate access needs requiring complete resource segregation.

Service accounts purpose and use cases

Service accounts run automated workloads in Grafana such as dashboard provisioning, configuration, or report generation. Common use cases include scheduling reports for specific dashboards on daily/weekly/monthly basis, defining alerts to be used in Grafana, setting up external SAML authentication providers, and interacting with Grafana without signing in as a user. Service accounts can only act in the organization they are created for.

Service account tokens for API authentication

Service account tokens are randomly generated strings used to authenticate with Grafana's HTTP API as an alternative to passwords. A service account can be linked to multiple access tokens that function the same as API keys. Multiple tokens can be created for the same service account to audit or manage actions separately, rotate compromised tokens, or support multiple applications with the same permissions. Tokens inherit permissions from the service account.

Grafana organization roles

Within an organization, Grafana has three primary organization roles: organization administrator, editor, and viewer, which dictate the user's level of access and permissions including the ability to edit data sources or create teams. An empty role is also available to start with and to which custom permissions can be gradually added. Every user must be assigned a role to be a member of any organization.

Server administrator role

Grafana provides a server administrator role that grants access to and enables interaction with resources affecting the entire instance, including organizations, users, and server-wide settings. This role can only be accessed by users of self-hosted Grafana instances and is intended for administrators of the Grafana instance.

Dashboard and folder permissions

Grafana allows precise permission settings on both dashboards and folders to control which users and teams can view, edit, and administer them. For example, a viewer user can be granted access to edit only one specific dashboard while viewing all dashboards. Dashboard and folder permissions can be set through the UI, APIs, or provisioned through Terraform.

Data source permissions in Grafana Enterprise

In Grafana Enterprise, granular permissions can be granted for data sources to control who can query and edit them.

Role-based access control (RBAC)

RBAC is a flexible approach to managing user access to Grafana resources including users, data sources, and reports. It is available in Grafana Enterprise and Grafana Cloud. RBAC comes with pre-defined roles such as data source writer which allows updating, reading, or querying all data sources. RBAC empowers users to generate personalized roles and modify permissions authorized by standard Grafana roles.

Role synchronization from identity providers

Grafana can synchronize basic roles from authentication providers by mapping attributes from the identity provider to the user role in Grafana. Users with specific attributes like role, team, or group membership in LDAP, OAuth, or SAML are automatically assigned the corresponding role in Grafana. Whenever a user logs in, Grafana checks for changes and updates the user's role accordingly.

Service accounts replacement of API keys

Service accounts will eventually replace API keys as the primary way to authenticate applications that interact with Grafana.

Create Grafana Cloud OAuth Client Credentials steps

To create OAuth client credentials: (1) Log in to Grafana Cloud, (2) Locate your organization and click OAuth Clients, (3) Click Add OAuth Client Application, (4) Add the name and URL of your running Grafana instance, (5) Click Add OAuth Client, (6) Copy the generated client ID and client secret.

auth.grafana_com configuration reference

The auth.grafana_com configuration section supports these options: enabled (boolean, enables the authentication provider), allow_sign_up (boolean, allows new users to sign up), auto_login (boolean, attempts login automatically and skips the login screen), client_id (string, OAuth client ID), client_secret (string, OAuth client secret), scopes (string, OAuth scopes requested, example value: user:email), allowed_organizations (string, restricts access to specific organizations), skip_org_role_sync (boolean, prevents synchronization of organization roles from Grafana Cloud).

auto_login setting behavior with multiple auth providers

When auto_login is set to true, Grafana attempts to log in users automatically and skips the login screen. This setting is ignored if multiple authentication providers are configured to use auto login.

skip_org_role_sync prevents Grafana Cloud role override

By default, when a user signs in with Grafana Cloud credentials, their assigned organization role from Grafana Cloud overrides the role defined in the Grafana instance. Setting skip_org_role_sync to true prevents this synchronization, allowing organization roles to be managed within Grafana instead of being overridden by Grafana Cloud.

Enable Grafana Cloud as Identity Provider

To use Grafana Cloud as an OAuth2 identity provider for a Grafana instance, generate a client ID and client secret from Grafana Cloud and configure them in the Grafana instance using the auth.grafana_com configuration section.

Example Grafana Cloud OAuth2 configuration

```ini [auth.grafana_com] enabled = true allow_sign_up = true auto_login = false client_id = 450bc21c10dc2194879d client_secret = eyJ0Ijoib2F1dGgyYyIhlmlkIjoiNzUwYmMzM2MxMGRjMjE6NDh3OWQiLCJ2IjoiZmI1YzVlYmIwYzFmN2ZhYzZmNjIwOGI1NmVkYTRlNWYxMzgwM2NkMiJ9 scopes = user:email allowed_organizations = sampleorganization enabled = true ``` This example shows a Grafana instance configured to use Grafana Cloud as an authentication provider with user sign-up enabled, automatic login disabled, and restricted to a single organization.

LDAP UI configuration permissions required

To configure LDAP authentication using the Grafana user interface, users must have permissions settings:read and settings:write with settings:auth.ldap:* scope.

SAML with Okta OIN application prerequisites

To configure SAML authentication with Okta using the Okta Integration Network (OIN) application, you need Grafana Enterprise or a paid Grafana Cloud account, and admin privileges in both Grafana and Okta.

Team Sync group matching is case insensitive

Group matching for team synchronization is case insensitive.

Team Sync overview

Team sync allows synchronization between authentication provider teams and Grafana teams. LDAP, OAuth, and SAML users who are members of certain teams or groups in their auth provider can be automatically added or removed as members of Grafana teams. Team sync is available in Grafana Enterprise and Grafana Cloud.

Team Sync supported authentication providers

Team sync is supported by the following providers: Auth Proxy, Entra ID, Generic OAuth integration, GitHub OAuth, GitLab OAuth, Google OAuth, LDAP, Okta, and SAML.

Team Sync synchronization timing

Synchronization between auth provider groups and Grafana teams happens when a user logs in, unless LDAP is used with active background synchronization enabled.

Team Sync user removal behavior

Grafana tracks which users have been synchronized into teams and will remove synchronized users from a team when their group membership in the auth provider changes. Users manually added to a team are not removed when the synchronized user logs in, allowing flexibility to combine LDAP group memberships with manual Grafana team assignments.

LDAP wildcard matching in Team Sync

When using LDAP for team sync, you can use a wildcard (*) in the common name attribute (CN) to match any group in the corresponding Organizational Unit (OU). For example, the pattern cn=*,ou=groups,dc=grafana,dc=org will match cn=users,ou=groups,dc=grafana,dc=org.

How to synchronize a Grafana team with an external group

To synchronize a Grafana team with an external group: (1) Navigate to Administration > Users and access > Teams in Grafana. (2) Select a team. (3) Go to the External group sync tab and click Add group. (4) Insert the value of the group you want to sync with, which becomes the Grafana GroupID. For LDAP, use the distinguished name (DN) of the LDAP group. For Auth Proxy, use the value from the custom Groups header. (5) Click Add group to save.

Viewer role query permissions vulnerability

Users with the Viewer role can enter any possible query in any of the data sources available in the organization, not just the queries defined on dashboards for which the user has Viewer permissions. This means a Viewer can make arbitrary queries to data sources and potentially access sensitive data beyond what appears on dashboards.

Restrict Viewer query access with data source permissions

To restrict Viewer query access to data sources, you can create multiple data sources with restrictions added in data source configuration, then use the Data Source Permissions Enterprise feature to restrict user access to the data source in Grafana.

Restrict Viewer query access with separate organization

To restrict Viewer query access, you can create a separate Grafana organization with a separate data source that has option/user/credentials settings that limit access to a subset of the data. Not all data sources have an option to limit access.

Security implications of anonymous dashboard access

When anonymous access is enabled in Grafana, anyone with the dashboard URL can access it as a Viewer without signing in. New dashboards are publicly available unless explicitly hidden from all Viewers. Anyone can edit or delete dashboards granted Edit or Admin abilities to Viewers. Anyone can make view API calls to list all folders, dashboards, and data sources. Anyone can make arbitrary queries to any configured data source.

View organization list as server admin

As a server admin, you can view the list of organizations by accessing the server admin view. Click the name of the organization that you want to edit.

View user list in Server Admin

To view the user list in Grafana: hover your cursor over the Server Admin (shield) icon until a menu appears, then click Users. You can search for specific user accounts using the search field on the Users page.

Modify folder permissions

To modify permissions for a folder, click Dashboards in the primary menu, navigate to the folder, click Folder actions on the folder's page, select Manage permissions in the drop-down, and update permissions as desired. Changes are saved automatically.

Folder permissions inheritance

Dashboards in a folder inherit any permissions assigned to the folder. You can assign permissions to organization roles, teams, and users at the folder level.

Explore role requirements

To access Explore, you must have either the 'editor' or 'administrator' basic role, or the 'data sources explore' role. Role-based access control (RBAC) can be used in Grafana Enterprise to manage Explore permissions.

Give your agent this brain