Github OAuth user organization fetch not working

Grafana Authentication
1

  • What Grafana version and what operating system are you using?
    Containerized Grafana OSS 11.0.0 in Ubuntu 22.04 and running on ECS Fargate.

  • What are you trying to achieve?
    Github Oauth integration with github organization filtering. And singup the user via github if not exists in Grafana.

  • How are you trying to achieve it?
    Following this documentation.

  • What happened?
    It seems like Grafana cannot able to fetch the organizations of the authenticated user, according to the debug logs it got an empty list for it. If i set the allowed_organizations property to "" it works, a user created via the github authentication.

  • What did you expect to happen?
    Working properly when i set theallowed_organizations to a github organization im in.

  • Can you copy/paste the configuration(s) that you are having problems with?
    My Github app created under the exact organization i want to use for and filter for, with the following permissions:

    • Organization permissions/Members: Read-only
    • Account permissions/Email addresses: Read-only

Im using the following environment variables and secrets in the ECS contianer definition:

"environment": [
    {
        "name": "GF_DEFAULT_APP_MODE",
        "value": "production"
    },
    {
        "name": "GF_LOG_LEVEL",
        "value": "debug"
    },
    {
        "name": "GF_SERVER_DOMAIN",
        "value": "/"
    },
    {
        "name": "GF_AUTH_GITHUB_ALLOW_SIGN_UP",
        "value": "true"
    },
    {
        "name": "GF_AUTH_GITHUB_ALLOWED_ORGANIZATIONS",
        "value": "REDACTED-ORG"
    },
    {
        "name": "GF_AUTH_GITHUB_API_URL",
        "value": "https://api.github.com/user"
    },
    {
        "name": "GF_AUTH_GITHUB_AUTH_URL",
        "value": "https://github.com/login/oauth/authorize"
    },
    {
        "name": "GF_AUTH_GITHUB_ENABLED",
        "value": "true"
    },
    {
        "name": "GF_AUTH_GITHUB_SCOPES",
        "value": "user:email, read:org"
    },
    {
        "name": "GF_AUTH_GITHUB_TOKEN_URL",
        "value": "https://github.com/login/oauth/access_token"
    },
    {
        "name": "GF_AUTH_GITHUB_SKIP_ORG_ROLE_SYNC",
        "value": "true"
    },
    {
        "name": "GF_AUTH_GITHUB_ROLE_ATTRIBUTE_PATH",
        "value": "Viewer"
    },
    {
        "name": "GF_SERVER_ROOT_URL",
        "value": "https://${grafana_domain}"
    }
],
"secrets": [
    {
        "name": "GF_SECURITY_ADMIN_USER",
        "valueFrom": "${grafana_admin_user_ssm}"
    },
    {
        "name": "GF_SECURITY_ADMIN_PASSWORD",
        "valueFrom": "${grafana_admin_password_ssm}"
    },
    {
        "name": "GF_AUTH_GITHUB_CLIENT_ID",
        "valueFrom": "/grafana/${environment}/GF_AUTH_GITHUB_CLIENT_ID"
    },
    {
        "name": "GF_AUTH_GITHUB_CLIENT_SECRET",
        "valueFrom": "/grafana/${environment}/GF_AUTH_GITHUB_CLIENT_SECRET"
    }
]
  • Did you receive any errors in the Grafana UI or in related logs? If so, please tell us exactly what they were.

UI Error

Login failed
User is not a member of one of the required organizations. Please contact identity provider administrator.

Debug logs

2024-07-18T09:13:06.259Z [grafana] logger=oauth.github t=2024-07-18T09:13:06.259226954Z level=debug msg="HTTP GET" url="https://api.github.com/user/teams?per_page=100" status="200 OK" response_body=[]

2024-07-18T09:13:06.400Z [grafana] logger=oauth.github t=2024-07-18T09:13:06.400857628Z level=debug msg="HTTP GET" url="https://api.github.com/user/orgs?per_page=100" status="200 OK" response_body=[]

2024-07-18T09:13:06.401Z [grafana] logger=authn.service t=2024-07-18T09:13:06.400955396Z level=error msg="Failed to authenticate request" client=auth.client.github error="[auth.oauth.userinfo.error] failed to get user info: [auth.missing_organization] User is not a member of any of the allowed organizations: [REDACTED-ORG]"
2

My bad, i was trying to do it with creating a basic Github App.
With the OAuth Apps (Organization page, Settings, Developer settings on the bottom left, OAuth Apps) it work properly. For this setup you need to be an admin in the Github org.

3

I was able to get authentication with an Github App working as far as i can tell.

I’ve selected the following permissions:

  • Organization permissions
    • Members (Read Only)
  • Account permissions
    • Email addresses (Read Only)

And then i had to install the GitHub App in the Organization i tried to do authentication against (probably the step you missed).

I guess it would be good to update the documentation and recommend this instead of using an OAuth App as it’s more granular in the permissions aspect as well as what GitHub recommends to use.

Also i’ve overriden the following two values from their false default:

use_pkce=true
use_refresh_token=true

PKCE because of PKCE support for OAuth and GitHub App authentication - GitHub Changelog

And use_refresh_token because there is an “Optional Feature” within the Apps settings (which was enabled by default for me) which looks like it enables use of refresh tokens:

User-to-server token expiration: User-to-server access tokens will expire after 8 hours. A Refresh Token will be provided which can be exchanged for a new access token.

Hoewer i haven’t validated wheter this actually works as expected but i haven’t had issues yet but i also don’t have that much expierience with the whole stack yet.