LDAP mapping for global admin role

sw2000 · May 17, 2017, 4:34pm

Is there a way to map a LDAP group to the global admin role?

jdbranham · May 18, 2017, 4:15am

Not out of the box, but looking at the ldap code, it doesn’t look too difficult to implement.

grafana/grafana/blob/master/pkg/login/ldap.go#L195




	if !access {
		a.log.Info("Ldap Auth: user does not belong in any of the specified ldap groups", "username", ldapUser.Username, "groups", ldapUser.MemberOf)
		return nil, ErrInvalidCredentials
	}


	// get user from grafana db
	userQuery := m.GetUserByLoginQuery{LoginOrEmail: ldapUser.Username}
	if err := bus.Dispatch(&userQuery); err != nil {
		if err == m.ErrUserNotFound && setting.LdapAllowSignup {
			return a.createGrafanaUser(ldapUser)
		} else if err == m.ErrUserNotFound {
			a.log.Warn("Not allowing LDAP login, user not found in internal user database, and ldap allow signup = false")
			return nil, ErrInvalidCredentials
		} else {
			return nil, err
		}
	}


	return userQuery.Result, nil