Generic_oauth "User not a member of one of the required organizations"

Grafana Authentication
1

I have Grafana configured with generic_oauth, with below configs enabled:

#################################### Generic OAuth ##########################
[auth.generic_oauth]
enabled = true
name = OAuth
allow_sign_up = true
client_id = 72
client_secret = yl
root_url = https://metrics.xyz.abc.info
scopes = openid profile email
auth_url = https://login.microsoftonline.com/c0/oauth2/authorize
token_url = https://login.microsoftonline.com/c**0/oauth2/token
api_url = https://graph.microsoft.com
allowed_organizations = Main Org.
role_attribute_path = contains(info.groups[], ‘AWS-xyz-Support’) && ‘Admin’ || ‘Viewer’

Expected:
Users under AWS-xyz-support group on infocorp dimain should be having Admin in Grafana, rest all Viewer.

Am getting below while perfomring Signon:

xxxxx lvl=info msg=“state check” logger=oauth queryState=125b0068ddd5a843bfe7c096887a41039b7050573525e3ca58468b28482ec460 cookieState=125b0068ddd5a843bfe7c096887a41039b7050573525e3ca58468b28482ec460
xxxxxx lvl=eror msg=“login.OAuthLogin(get info from generic_oauth)” logger=context userId=0 orgId=0 uname= error=“User not a member of one of the required organizations”
t=2019-11-15T07:03:07+0000 lvl=eror msg=“Request Completed” logger=context userId=0 orgId=0 uname= method=GET path=/login/generic_oauth status=500 remote_addr=1x.1xx.xx.xx time_ms=459 size=1750 referer=https://login.microsoftonline.com/

is there any attributes am missing??

2

The " allowed_organizations" is not the Grafana org that the users are intended to be provisioned for.

It seems to be the orgs in your Oauth provider that the user needs to be a member of in order to be able to authenticate.

3

Keep an eye here… I think this may be what you’re trying to do

4

The answer that worked for me is:

Adding Additional Claim in Azure AD → App Registration → → Token Configuration → Add Group Claim