alex/infrastructure
Watch
1
0
Fork
You've already forked infrastructure
 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

Log grafana in through tsidp as a full admin #225

Merged
alex merged 1 commit from wiring-guru/grafana-oidc-role-refs into main 2026-11-11 11:41:53 -07:00 AGit
Conversation 0 Commits 1 Files changed 1 +2 -1
wiring-guru commented 2026-11-11 11:41:00 -07:00
Contributor
Copy link

tsidp supplies no role claim, so the role comes from a static JMESPath literal:
GrafanaAdmin, with allow_assign_grafana_admin so Grafana syncs the server admin
role instead of downgrading it to org admin. role_attribute_strict stays on, so a
token the expression cannot resolve still fails closed rather than silently
falling back to auto_assign_org_role.

Grafana's ini loader unescapes one level of quotes, so the literal has to reach it
double-quoted: a bare 'GrafanaAdmin' would arrive as GrafanaAdmin, a JMESPath field
lookup that returns nothing and turns every login into "IdP did not return a role
attribute". Checked against grafana 13.1.1, the version chart 12.8.0 deploys.

tsidp supplies no role claim, so the role comes from a static JMESPath literal: GrafanaAdmin, with allow_assign_grafana_admin so Grafana syncs the server admin role instead of downgrading it to org admin. role_attribute_strict stays on, so a token the expression cannot resolve still fails closed rather than silently falling back to auto_assign_org_role. Grafana's ini loader unescapes one level of quotes, so the literal has to reach it double-quoted: a bare 'GrafanaAdmin' would arrive as GrafanaAdmin, a JMESPath field lookup that returns nothing and turns every login into "IdP did not return a role attribute". Checked against grafana 13.1.1, the version chart 12.8.0 deploys. 
tsidp supplies no role claim, so the role comes from a static JMESPath literal:
GrafanaAdmin, with allow_assign_grafana_admin so Grafana syncs the server admin
role instead of downgrading it to org admin. role_attribute_strict stays on, so a
token the expression cannot resolve still fails closed rather than silently
falling back to auto_assign_org_role.

Grafana's ini loader unescapes one level of quotes, so the literal has to reach it
double-quoted: a bare 'GrafanaAdmin' would arrive as GrafanaAdmin, a JMESPath field
lookup that returns nothing and turns every login into "IdP did not return a role
attribute". Checked against grafana 13.1.1, the version chart 12.8.0 deploys.
wiring-guru force-pushed wiring-guru/grafana-oidc-role-refs from 20a25c67a3 to ec4b5770fb
All checks were successful
Apply Argo CD Applications / update-repo-folder (push) Successful in 1s
Details
Apply Argo CD Applications / update-repo (push) Successful in 0s
Details
Apply Argo CD Applications / apply-applications (push) Successful in 2s
Details
2026-11-11 11:41:27 -07:00 Compare
alex merged commit ec4b5770fb into main 2026-11-11 11:41:53 -07:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
alex/infrastructure!225
No description provided.