I would like to embed a grafana panel in a website, but wondering how to add security. all the blogs i read and not had any solution to this.
The only way I have implemented so far is to enable grafana anonymous mode for an organisation, and put an apache reserve proxy between grafana and the web site, and verify the server url is from my site in apache.
Sounds like you have already found the best solution. This is not a scenario that we (the core team) want to spend time on enabling.
I am not happy using grafana in anonymous mode for security reasons, as it only supports one organisation to my knowledge, we have many customers and want to embed a different panel for each customer, and we then have to use grafana on a public url even with a reverse proxy for the iframe content.
Putting a reverse proxy in place and just verify the source url ,this url can be hacked i think.
So, Grafana does not seem suited to putting a grafana panel into a third party web site with really good security? we authenticate users but do not want them cutting/pasting the url inside the frame and potentially sharing it or hacking the panel id to see another customer.
Perhaps some type of snapshot sharing solution would work, although it involves a lot of extra work on out side to manage this, limited access, timeout etc. we want to host our own snaphots for privacy reasons.
I know some people have got this to work but I don’t know the details. Just by googling “grafana iframe authentication”, I found:
This is incorrect. Grafana has multi-tenant support (you can create multiple organizations that do not have access to other organizations’ dashboards).
Also, in the current Grafana 5.0 beta, a new feature is dashboard permissions: http://docs.grafana.org/v5.0/administration/permissions/#dashboard-folder-permissions so you can grant access to a folder (also a new feature) or to an individual dashboard.
I am facing the same issue of providing authentication. Did you find any suitable solution to this?
If yes then can you please share it here. It will help us a lot. (I am using the grafana v7.0.3)
I am facing the same issue.Do you have any solution?
I see that I can use the snapshot feature to deploy the grafana dashboard/panel to Raintank, which has anonymous access.
And then on the raintank grafana dashboard, I can share that to get an iframe to embed somewhere else, that anyone can view without logging in.
But then when I embed that iframe on Confluence, I get CORS issues, such as
" Access to fetch at ‘https://snapshot.raintank.io/img/online.svg’ from origin ‘null’ has been blocked by CORS policy: No ‘Access-Control-Allow-Origin’ header is present on the requested resource. If an opaque response serves your needs, set the request’s mode to ‘no-cors’ to fetch the resource with CORS disabled.
Anyone know why this is?
@daniellee, is there anything team developed in recent Grafana 8 release ?