Fix Grafana Tailscale login role mapping #224
Loading…
Reference in a new issue
No description provided.
Delete branch "wiring-guru/grafana-oidc-role-refs"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Grafana's ini loader unescapes role_attribute_path = 'Viewer' to Viewer, which JMESPath reads as a field lookup on tsidp's token; role_attribute_strict then rejects the login. Double-quote the literal so Grafana hands JMESPath the 'Viewer' literal.
Grafana's config loader unescapes a quoted ini value, so role_attribute_path = 'Viewer' reached the OAuth provider as bare Viewer: a JMESPath field lookup on tsidp's ID token, which carries no such claim. The lookup returned nothing, and role_attribute_strict turned that into a failed login ("IdP did not return a role attribute"). Double-quoting the literal makes the loader strip the outer quotes and hand JMESPath the 'Viewer' literal. Verified against grafana 13.1.1 (the version chart 12.8.0 deploys): /api/admin/settings reports role_attribute_path = 'Viewer' and JMESPath resolves it to the Viewer role.