Skip to content

EPMDEDP-17184: fix: drop unregistered groups scope that broke Grafana OIDC login #4

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
SergK merged 1 commit into from
Jul 28, 2026
+2 −16
Merged

EPMDEDP-17184: fix: drop unregistered groups scope that broke Grafana OIDC login #4

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions deploy-templates/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,10 +126,9 @@ and `config/grafana/dashboards/`). See the repository root `README.md` for the f
| grafana."grafana.ini"."auth.generic_oauth".client_id | string | `"grafana-claude-code-telemetry"` | |
| grafana."grafana.ini"."auth.generic_oauth".email_attribute_path | string | `"email"` | |
| grafana."grafana.ini"."auth.generic_oauth".enabled | bool | `false` | |
| grafana."grafana.ini"."auth.generic_oauth".groups_attribute_path | string | `"groups"` | |
| grafana."grafana.ini"."auth.generic_oauth".name | string | `"SSO"` | |
| grafana."grafana.ini"."auth.generic_oauth".role_attribute_path | string | `"contains(roles[*], 'administrator') && 'Admin' || contains(roles[*], 'developer') && 'Editor' || 'Viewer'"` | |
| grafana."grafana.ini"."auth.generic_oauth".scopes | string | `"openid profile email roles groups"` | |
| grafana."grafana.ini"."auth.generic_oauth".scopes | string | `"openid profile email roles"` | |
| grafana."grafana.ini"."auth.generic_oauth".token_url | string | `"https://keycloak.example.com/realms/main/protocol/openid-connect/token"` | |
| grafana."grafana.ini".analytics.check_for_updates | bool | `false` | |
| grafana."grafana.ini".server.root_url | string | `"https://grafana.example.com"` | |
Expand Down
10 changes: 0 additions & 10 deletions deploy-templates/templates/keycloak/keycloakclient-grafana.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,14 +29,4 @@ spec:
"id.token.claim": "true"
"userinfo.token.claim": "true"
"multivalued": "true"
# Expose group membership so Grafana can gate access (allowed_groups) and map org roles.
- name: groups
protocol: openid-connect
protocolMapper: "oidc-group-membership-mapper"
config:
"access.token.claim": "true"
"claim.name": "groups"
"id.token.claim": "true"
"userinfo.token.claim": "true"
"full.path": "false"
{{- end }}
5 changes: 1 addition & 4 deletions deploy-templates/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -327,17 +327,14 @@ grafana:
allow_sign_up: true
client_id: grafana-claude-code-telemetry
# Client secret comes from the GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET env var (envValueFrom above) — never inline it here.
scopes: openid profile email roles groups
scopes: openid profile email roles
email_attribute_path: email
# Keycloak endpoints (any OIDC provider exposes equivalents):
auth_url: https://keycloak.example.com/realms/main/protocol/openid-connect/auth
token_url: https://keycloak.example.com/realms/main/protocol/openid-connect/token
api_url: https://keycloak.example.com/realms/main/protocol/openid-connect/userinfo
# Map provider roles/groups to Grafana org roles (JMESPath over the userinfo/token claims).
role_attribute_path: contains(roles[*], 'administrator') && 'Admin' || contains(roles[*], 'developer') && 'Editor' || 'Viewer'
# Restrict sign-in to members of specific groups (requires the `groups` claim):
groups_attribute_path: groups
# allowed_groups: /grafana-users

# Grafana admin credentials from the same grafana-sso Secret.
# admin:
Expand Down
Loading