Hello Grafana Community,
I have integrated Keycloak with Grafana, and I am able to login in grafana using keycloak flow from browser. But when I used the Basic auth to fetch/create the service account it failed as instead of Basic auth I need to use the Bearer Token to authenticate/Authorize the user.
While doing the same using the access_token from keycloak as a Bearer Token in grafana, I’m facing an issue with authorization.
Here’s what I’ve done so far:
- Successfully fetched an
access_tokenfrom Keycloak using below curl command:
curl -X POST “https://<keycloak_url>/auth/realms/<my_realm>/protocol/openid-connect/token”
-H “Content-Type: application/x-www-form-urlencoded”
-d “grant_type=password”
-d “client_id= <client_name>”
-d “client_secret= <client_secret>”
-d “username=<user_name>”
-d “password=<valid_password>”
-d “scope=openid” -k
- Used the obtained access_token from above step as a Bearer token in the API call to Grafana’s
/api/serviceaccountsendpoint. Below is the curl command for the same:
curl -X GET “http://<grafana_ip>:<grafana_port>/api/serviceaccounts”
-H “Content-Type: application/json”
-H “Authorization: Bearer $token”
-k
Unfortunately, the request fails with a 401 Unauthorized error. Below is the response of above command:
{
“extra”: null,
“message”: “Invalid API key”,
“messageId”: “api-key.invalid”,
“statusCode”: 401,
“traceID”: “”
}
Here is the grafana.ini entry:
[auth.generic_oauth]
name = keycloak
enabled = true
allow_sign_up = true
auto_login = false
use_pkce = true
use_refresh_token = true
tls_skip_verify_insecure = true
client_id = <Client_id>
client_secret =
auth_url = https://<keycloak_url>/auth/realms/<my_realm>/protocol/openid-connect/auth
token_url = https://<keycloak_url>/auth/realms/<my_realm>/protocol/openid-connect/token
api_url = https://<keycloak_url>/auth/realms/<my_realm>/protocol/openid-connect/userinfo
redirect_uri = http://<grafana_url>:<grafana_port>/login/generic_oauth
role_attribute_path = contains(realm_access.roles[], ‘EM_admin’) && ‘GrafanaAdmin’ || contains(realm_access.roles[], ‘Admin’) && ‘Admin’ || ‘Viewer’
auto_assign_org_role = false
skip_org_role_sync = false
allow_assign_grafana_admin = true
email_attribute_path = email
login_attribute_path = username
name_attribute_path = name
role_attribute_strict = false
org_attribute_path = “Admin”
role_mapping = {“Admin”: “Admin”, “Editor”: “Editor”, “default”: “Editor”}
scopes = openid email profile roles
signout_redirect_url = https://<keycloak_url>/auth/realms//protocol/openid-connect/logout?post_logout_redirect_uri=http://<grafana_url>:<grafana_port>/login
Below the Keycloak configurations:
I suspect I might be missing some configuration or steps to properly set up authentication between Keycloak and Grafana. Could anyone provide guidance on:
- Correctly configuring Grafana to recognize Keycloak tokens.
- Ensuring that the token is valid for accessing Grafana’s API endpoints.
- Any specific Grafana settings or Keycloak configurations needed for service account access.
Any help or documentation references would be greatly appreciated!
Thank you in advance for your assistance.
Best regards,
Vikram Goel