LDAP Config UI vs. TOML file, what is used?!

Grafana Authentication
1

We have Grafana 12.4.2 with LDAP auth active and I noticed a strange bahaviour.

The LDAP Config (Group Mapping, Lookups, etc.) are stored in a *.TOML file in the grafana config folder and referenced to by the “default.ini” config file.

As it should be according to the documentation.

LDAP config works.

However when changing the LDAP config in the UI “Administration → Authentication → LDAP” e.g. the “Search Filter” property this is saved in Grafana and also persistent after a service restart.

In the end the values configured in the *.TOML file that should be used are not used anymore and also do not get applied again after restart, which makes the config in the *.TOML file kind of useless and overall is confusing what LDAP config is active now.

Expected behaviour would be that if LDAP is configured in a .TOML file this config is the one that gets used and it cannot be changed in the UI when not also refelected in the *.TOML file.

Imho, if a *.TOML file is used for configuring LDAP Auth nobody should be able to change it in the UI like a provisioned setup?

  • What Grafana version and what operating system are you using?

    • Grafana 12.4.2

  • What are you trying to achieve?

    • Figure out what config Grafana uses and where it is saved

  • How are you trying to achieve it?

    • UI and TOML file

  • What happened?

    • A LDAP Auth change in the UI seems to be saved somewhere and the configured *.toml file is not used anymore as it seems.

  • What did you expect to happen?

    • On Service start the TOML file gets read and is used for LDAP auth

  • Did you receive any errors in the Grafana UI or in related logs? If so, please tell us exactly what they were.

    • No

  • Did you follow any online instructions? If so, what is the URL?

    • LDAP setup documentation on Grafana website
2

I was able to reproduce this behavior on Grafana 12.4.2.
What happens is
Initially Grafana reads LDAP settings from ldap.toml
After modifying LDAP configuration in:
Administration → Authentication → LDAP

Screenshot (321)
Screenshot (321)1920×839 82.7 KB

Grafana stores the authentication configuration internally in its database.
These UI-stored settings take precedence over ldap.toml

Screenshot (324)
Screenshot (324)1920×860 86.9 KB

Restarting Grafana does not reload values from ldap.toml while UI overrides exist.
I verified this by configuring LDAP via ldap.toml changing the search filter value in the UI restarting Grafana observing that the UI-modified value persisted and the
toml value was ignored using reset to default values restarting Grafana again LDAP then reverted back to file-based configuration

Screenshot (323)
Screenshot (323)1920×846 83.4 KB

So this appears to be expected behavior in newer Grafana versions
According to Grafana documentation, UI authentication settings override file-based configuration once saved through the UI.

3

I cannot test this now myself, but does this mean the reset to the default config in the LDAP Auth UI reverts everything to the *.toml file settings?