Problem sso keycloak and cookie samesite

Grafana
1

Hello,
there is a grafana and keyclaok (latest version) with an application under docker, the application and grafana are configured for an sso connection with keycloak and works!
The problem occurs when we want to access grafana in the application via an iframe

  • Configuration
    #################################### Generic OAuth ##########################
    [auth.generic_oauth]
    enabled = true
    name = keycloak
    allow_sign_up = true
    client_id = grafana
    client_secret = […]
    scopes = openid profile email roles
    email_attribute_name = email
    email_attribute_path = email
    auth_url = http://[…]/auth/realms/poc/protocol/openid-connect/auth
    token_url = http://[…]/auth/realms/poc/protocol/openid-connect/token
    api_url = http://[…]/auth/realms/poc/protocol/openid-connect/userinfo
    tls_skip_verify_insecure = true
    cookie_samesite = lax
    allow_embedding = true

I manage to work around the problem, by disabling the samesite cookies on chrome: // flags / but this is not a viable solution

image
image879×139 11.7 KB

in addition if the samesite cookie value is lax in grafana.ini, on firefox I get this error:

image
image1241×317 16.9 KB

Does someone have an idea ?

2

Cookie samesite config must be none, when you want to use it in the iframe.

3

thank you for your reply,

by changing the value of the samesite to none, I get the following result:

is it possible to add the Secure attribute to the cookie?

4

  • Chrome access iframe - ko
    image
    with an error on keycloak “invalid_code”

  • mozilla firefox and iframe ok
    there is however a warning in the console

The “sf_redirect” cookie will be released soon because its “SameSite” attribute is set to “None” or an invalid value and it does not have the “secure” attribute

5

Of course there is option to set secure flag, see security section


It is mentioned in the doc, which will be good starting point for Grafana administration https://grafana.com/docs/grafana/latest/administration/configuration/#cookie_secure