Keycloak Oauth check empty users email

Grafana Authentication
1

Grafana 9.1.6
Keycloak 18.0.2
I wonder if there any way in grafana.ini (default.ini) to check if user has an email, and if he doesnt, then make it use username as email. In example like that:
[auth.generic_oauth]
email_attribute_path = checkNotNull(user.email) && preferred_email || preferred_username

  • What Grafana version and what operating system are you using?

  • What are you trying to achieve?

  • How are you trying to achieve it?

  • What happened?

  • What did you expect to happen?

  • Can you copy/paste the configuration(s) that you are having problems with?

  • Did you receive any errors in the Grafana UI or in related logs? If so, please tell us exactly what they were.

  • Did you follow any online instructions? If so, what is the URL?

2

Check for the presence of an e-mail address using the JMESPath specified via the email_attribute_path configuration option. The JSON used for the path lookup is the HTTP response obtained from querying the UserInfo endpoint specified via the api_url configuration option. Note: Only available in Grafana v6.4+.

So you just need to write right JMESPath expressions for email_attribute_path. I would use contains JMESPath Specification — JMESPath - test if key exists (not if key is null)

Maybe (test it develop, improve it):

(contains(keys(@), 'user')) && (contains(user, 'email')) && user.email || preferred_email || preferred_username
1 Like
3

Thanks! It really helped.