I currently have my keycloak configured for SAML on grafana. i have logs of me having a session with grafana saying i did authenticate but i keep going to the log in screen. Im using Linux, and using version 11.1.0 Currently my Auth.saml looks like this: assertion_attribute_name = name assertion…

i got it to work thank you. turns out i was putting first name in to the name attribute but it kept coming in blank. i changed it to username and works great. thank you for the help

Be familiar that Role != Group. You didn’t configure any role mapping. Visual example: [image]

i dont have that authentication Tab on mine. i have total admin access but neither me or my coworkers have that tab. we have been doing that stuff in the config file from my understanding with this: assertion_attribute_name = name assertion_attribute_login = username assertion_attribute_email = em…

[image] sushi121123: i dont have that authentication Tab on mine Yes, that’s just UI. You don’t need UI - you can everything control from the config file. It is always good to read a doc: Configure SAML authentication using the configuration file | Grafana documentation But my point was to …

i now added: assertion_attribute_groups = Group assertion_attribute_role = role role_values_viewer = external role_values_editor = editor, developer role_values_admin = admin, operator role_values_grafana_admin = superadmin keycloak i added role list with the role mapper with the role attribute na…

[image] sushi121123: still no success That’s not debugging. Always check if you have what you configured. For example you configured assertion_attribute_groups = Group, so check if you have Group in the SAML response. Both sides (Grafana saml config and SAML response) must be matching, so ver…

[image] sushi121123: how can i go about getting the correct logs for this issue? [image] Keycloak saml for grafana Authentication Check debug logs first. To enable debug logging edit the configuration file grafana.ini: [log] # Either "console", "file", "syslog". De…

listed an issue of it failing to map name, which i ended up mapping in keycloak. now after updating the logs and reading /var/log/grafana its not updating and for some reason i cannot log into chrome at all now with ldap. but on fire fox is does work with ldap (saml is still broken). i also noticed…

after changing cookie_samesite = lax and cookie_secure = true i can now log into chrome and edge with ldap. but now im getting the "Failed to determine the state of the SSO redirect” on all browsers

You are mixing setups, e.g. saml with ldap. You didn’t provide any logs, how your saml response looks like - there can be billions things what can be wrong and based on your input there is no way to help you, sorry.

Grafana role mapping for Keycloak SAML auth

Grafana Authentication

jangaraj October 30, 2024, 2:14pm 8

Topic		Replies	Views
SAML - Grafana role with IDP group linking Configuration saml , keycloak	5	272	December 24, 2024
Grafana OAuth with Keycloak roles mapping Authentication value-mapping , grafana-roles	4	605	December 5, 2024
Keycloak saml for grafana Authentication saml	2	242	October 29, 2024
SAML Auth with LDAP Authentication ldap , saml	4	189	November 21, 2024
Grafana saml authen Authentication templating	1	815	October 21, 2022

Grafana role mapping for Keycloak SAML auth

Related topics