Hello,
I spent some time configuring LDAP authentication for grafana community (latest) over configuration file by following official guide but I was unable to get it working.
Then I did SAME configuration in the GUI and it started working. I saw that all the all the settings I did in configuration file are not present in the GUI, it’s like it was totally ignored. I made edits to /etc/grafana/ldap.toml . Is this expected behavior?
This can happen for a couple of reasons:
LDAP must be enabled in grafana.ini:
[auth.ldap]
enabled = true
config_file = /etc/grafana/ldap.toml
allow_sign_up = true
Without enabled = true, Grafana ignores ldap.toml.
If you’re using Grafana v11.3 or later, be aware that UI configuration takes precedence:
If LDAP is configured through Administration → Authentication → LDAP, those settings are stored in the database and override the corresponding settings in ldap.toml.
If you’ve configured LDAP in the UI after testing the file-based configuration, that can make it appear as though changes to ldap.toml are no longer being applied.
If you want Grafana to use only ldap.toml, make sure there isn’t an LDAP configuration saved through the UI that overrides it, then restart Grafana after editing ldap.toml.
I have enabled LDAP in grafana.ini, still no configuration settings in config file could be seen inside GUI.
If enabled = true is already set, then I wouldn’t expect the contents of ldap.toml to automatically appear in the GUI. The GUI stores its own LDAP configuration in the database → it isn’t a viewer for ldap.toml.
To verify that Grafana is actually loading ldap.toml, I’d check:
config_file points to the correct path.
The file is readable by the Grafana process.
There are no parsing errors in the Grafana startup logs.
Grafana was restarted after editing ldap.toml.
You could also temporarily enable LDAP debug logging to see whether Grafana is loading and parsing the configuration.
If you can share your Grafana version and any LDAP related log output, that would help narrow it down further.
grafana version 13.1.0
I’ll try to get this info in following days as I am bit short of time currently. I still need to make some configuration in another environment so I wanted to get info about what takes precendce.
Initially I started doing LDAP configuration over GUI but I couldn’t get to a point where I can do test so I switched to text file and found out that text files edits are not reflecting inside GUI, even after service restart. Could this be simply a feature where if you start configuration adjustment in GUI then a feature flag changes somewhere in database and all text file edits are ignored?