Grafana login form using Apache credentials

Grafana Authentication
1

I read the configuration with Grafanas auth.proxy and the Apache <Proxy *> configuration, but it seems that this isn’t what I want, and I’m not able to change the Apache configuration.

Is there a way that the Grafana logon prompt simply accepts the Apache credentials?
So, if a user navigates to Grafana, the logon prompt of Grafana is shown.
The user enters the credentials from Apache and is authenticated in Grafana.

Alternatively, I would use the Linux operating system users to logon with Grafana.

I want to prevent users to manage new credentials, as all of them already exists in Apache and OS.

Background is, my Grafana installation is a plugin of a special Debian distribution for Smart Homes. Therefore, there will be 5000+ installations of this Grafana plugin, and every user is Admin on his installation. Linux and Apache credentials are provided by the Debian distribution. “As a plugin” I’m not permitted to extend the Apache config. I want to provide a way to get the users “in” without further credentials, they should use what the Debian distribution provides.

Thanks,
Christian

2

Unfortunately not. I’m sure you’ve seen the list of auth backends supported by Grafana: Configure authentication | Grafana documentation, which does not directly include what you’re after. I can’t think of a particularly straightforward way to do exactly what you’re talking about, but maybe someone else here has better ideas.

From my perspective, I feel like your best bet is still the auth proxy method. I don’t know enough about your setup to really comment further though…e.g. you say you can’t change the Apache config, which makes me wonder which parts of the system you can change. Note that with auth proxy enabled, Grafana basically outsources authentication to the proxy. I.e. Apache itself performs whatever auth is required, and simply tells Grafana who is logged in (via the auth header) as part of the proxying process. The user wouldn’t see a Grafana login prompt at all.

If you can’t modify the Apache config, though (not eve add a new “site” to it?), I think you might be pretty stuck.