So I’ve got grafana and authentik running nicely, but I’ve never been able to make authentik work as an oauth provider for authentik. I have the following grafana.ini config in my helm chart (I’ve redacted the domain just for a bit of privacy):
grafana.ini:
users:
auto_assign_org: true
auto_assign_org_id: 1
auto_assign_org_role: Viewer
auth:
signout_redirect_url: https://auth.*****/application/o/grafana/end-session/
oauth_auto_login: true
auth.generic_oauth:
enabled: true
name: Authentik
client_id: $__env{GF_AUTH_GENERIC_OAUTH_CLIENT_ID}
client_secret: $__env{GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET}
scopes: openid profile email
login_attribute_path: preferred_username
groups_attribute_path: groups
name_attribute_path: name
empty_scopes: false
use_pkce: true
icon: signin
auth_url: https://auth.*****/application/o/authorize/
token_url: https://auth.*****/application/o/token/
api_url: https://auth.*****/application/o/userinfo/
role_attribute_path: contains(groups, 'Grafana Admins') && 'Admin' || contains(groups, 'Grafana Editors') && 'Editor' || 'Viewer'
server:
domain: grafana.*****
root_url: https://grafana.*****
When I try to login with authentik, I am able to go through the sign in prompts, but then I get redirected to the login screen where grafana says “login sync failed”. I’m guessing this has something to do with grafana not being able to map the authentik user to the existing grafana user but I’m not sure. Both my grafana and authentik username are the same. I see you can add JMESPath expressions under the “user mapping” section on the UI, but I have no idea how these work.
If anyone could point me in the right direction, that would be appreciated.