"Allow sign-up" in Grafana LDAP Authentication UI is ignored

Grafana
,
1

Hi,

it seems, the “Allow sign-up” in Administration → Authentication → LDAP is completely ignored. I can control the sign-up only via /etc/grafana/grafana.ini → [auth.ldap] → allow_sign_up = true|false even though the documentation at Configure LDAP authentication using the Grafana user interface | Grafana documentation says, that

Any configuration changes made through the Grafana user interface (UI) will take precedence over settings specified in the Grafana configuration file or through environment variables

The “Allow sign-up” in the UI LDAP configuration doesn’t seem to have any effect. E.g. with [auth.ldap] → allow_sign_up = true and the UI configuration like

root:/etc/grafana# sqlite3 /var/lib/grafana/grafana.db "select settings from sso_setting" | jq
{
  "active_sync_enabled": true,
  "allow_sign_up": false,
  "config": {
    "servers": [
      {
        "attributes": {
          "email": "mail",
          "member_of": "memberOf",
          "name": "givenName",
          "surname": "sn",
          "username": "cn"
        },
        "bind_dn": "XXXXX",
        "bind_password": "XXXXX",
        "client_cert_value": "",
        "group_search_filter": "",
        "group_search_filter_user_attribute": "",
        "host": "XXXXX",
        "port": 636,
        "search_base_dns": [
          "XXXXX"
        ],
        "search_filter": "(cn=%s)",
        "skip_org_role_sync": false,
        "start_tls": false,
        "timeout": null,
        "use_ssl": true
      }
    ]
  },
  "enabled": true,
  "skip_org_role_sync": false,
  "sync_cron": "0 1 * * *"
}
root:/etc/grafana#

Signup with an LDAP account is possible. With the reverse settings it isn’t.

This is with Grafana 13.1.1 on Debian 13/Trixie.

Is that to be expected (and why) or a bug or a misconception on my side, how the file based configuration interacts with the UI configuration?

2

Hi,

Based on your testing, allow_sign_up from grafana.ini does appear to be taking precedence over the value stored in sso_setting, which doesn’t match the documented behavior that UI-managed settings should override the configuration file.

One thing to check first is [auth.ldap] still configured with a config_file pointing to a legacy ldap.toml? If so, it’s worth confirming whether Grafana is using the legacy LDAP configuration instead of the UI-managed one.

If you’re using only the UI-managed LDAP configuration (no config_file/ldap.toml) and the UI’s Allow sign-up setting is still ignored while changing grafana.ini takes effect, then this would strongly suggest a bug.

As a workaround for now, allow_sign_up from grafana.ini appears to be the effective setting in your current configuration.

For reference

It reports another bug in the LDAP settings resolution when ssoSettingsLDAP is enabled. That issue is specifically about config_file not being resolved correctly rather than allow_sign_up, so it doesn’t prove this is the same bug, but it does show there are existing issues in this area.