Skip to content
Pocket ID
v2.19.1GitHub

Grafana

Sign in to Grafana with Pocket ID.

Create the client in Pocket ID

Section titled “Create the client in Pocket ID”
  1. In Pocket ID, open Administration → OIDC Clients and click Add OIDC Client.
  2. Enter a name such as Grafana and add the callback URL https://grafana.example.com/login/generic_oauth.
  3. Click Create and copy the Client ID and the Client secret. Under Show more details, also copy the Authorization URL and the Token URL. The client secret is only shown once.
  4. On the client’s Access tab, select the groups that may sign in under Allowed User Groups, or choose All Users.

Configure Grafana

Section titled “Configure Grafana”
  1. Log in to Grafana as the admin user.
  2. Open Administration → Authentication and select Generic OAuth.
  3. Under General Settings, fill in the fields:
    • Display Name: Pocket ID or something similar.
    • Client Id: the Client ID from Pocket ID.
    • Client secret: the Client secret from Pocket ID.
    • Auth style: Auto Detect
    • Scopes: openid, email and profile
    • Auth URL: the Authorization URL from Pocket ID.
    • Token URL: the Token URL from Pocket ID.
    • Leave API URL and Sign out redirect URL empty.
    • Leave Allow sign up and Auto login disabled.
  4. Under User mapping:
    • Only set Email attribute name to email:primary and leave all other fields empty.
    • Only enable Skip organization role sync and leave the other toggles disabled.
  5. Nothing needs to be done under Extra security measures.
  6. Save the settings.
  7. Create a new admin user or update the existing admin user under Users so that it has the same email address as your user in Pocket ID. Also set the username to the same email address.
  8. Log out and sign in with Pocket ID to test it.

Role mapping

Section titled “Role mapping”

To assign roles automatically based on group membership:

  1. Add groups to the Scopes setting: openid email profile groups
  2. Set the role attribute path according to the examples. For example, role_attribute_path: contains(groups[*], 'Monitoring Admin') && 'Admin' || contains(groups[*], 'Monitoring') && 'Editor' || 'Viewer' grants the “Admin” role to anyone in the “Monitoring Admin” group, the “Editor” role to anyone in the “Monitoring” group, and the “Viewer” role to any other signed-in user.
  3. Log out and back in to update your role.

Common problems

Section titled “Common problems”
  • If you get locked out of your account before the OAuth setup is completed and need to reset the password, see the Grafana CLI documentation.
  • If login fails because the callback URL is wrong and you are behind a reverse proxy, you might need to set root_url in grafana.ini so that it uses https, for example https://grafana.example.com/.
  • If everything is set according to the steps above and you still get Login failed: Sign up is disabled, you might need to set oauth_allow_insecure_email_lookup=true in the [auth] section of grafana.ini.