Grafana is an open source platform for analytics visualizations and monitoring. It supports using LDAP as an authentication mechanism into its interface. General instructions for setting up LDAP can be found here:
Detailed instructions on how to use Foxpass's LDAP with Grafana are below.
Note your Base DN on the dashboard page and mark it down.
Create an LDAP Binder account with the name 'grafana' (or easily identifiable) on the LDAP binders page. Copy/paste the generated password! It is only displayed once.
Also make a note of the binder's CN (i.e. cn=grafana,dc=≪example≫,dc=≪com≫).
Now it's time to configure Grafana. By default, LDAP authentication is disabled. To enable it, add the following to 'grafana.ini':
... [auth.ldap] enabled = true allow_sign_up = true config_file = /etc/grafana/ldap.toml ...
In the example above, the 'allow_sign_up' variable is set to true, which allows Grafana to create new users if LDAP Authentication is successful. The 'config_file' variable is set to the path of the 'ldap.toml' file, which you can create now. After creating the 'ldap.tomi' file, fill it in with these values, inserting your own information where marked by the double arrows:
... verbose_logging = true [[servers]] host = "ldap.foxpass.com" port = 636 use_ssl = true start_tls = false ssl_skip_verify = false bind_dn = "cn=grafana,dc=≪example≫,dc=≪com≫" bind_password = '≪binder password≫' search_filter = "(uid=%s)" search_base_dns = ["dc=≪example≫,dc=≪com≫"] [servers.attributes] name = "gn" surname = "sn" username = "cn" member_of = "memberOf" email = "mail" [[servers.group_mappings]] group_dn = "cn=≪grafana-admins≫,ou=groups,dc=≪example≫,dc=≪com≫" org_role = "Admin" [[servers.group_mappings]] group_dn = "cn=≪grafana-editors≫,ou=groups,dc=≪example≫,dc=≪com≫" org_role = "Editor" [[servers.group_mappings]] group_dn = "*" org_role = "Viewer" ...
Replace the 'bind_password' value with the binder password from the first step. Additionally, you can use Foxpass groups to grant certain Grafana permissions. In the example above, users in the 'grafana-admins' group in Foxpass are marked as Admins in Grafana, and users in the 'grafana-editors' group are marked as Editors. All other users not belonging to either group are marked as Viewers.
The official Grafana documentation contains a fully documented 'ldap.toml' example, as well: http://docs.grafana.org/installation/ldap/
After saving the 'ldap.toml' file, restart Grafana, and log in with your Foxpass credentials!
If you want to run Grafana on Kubernetes and integrate it with Foxpass, Grafana Helm Chart provides an easy way to set it up.
Rename the 'ldap.toml' file from the earlier instructions to 'ldap-toml' as required by Grafana Helm Chart.
Then create an existing Kubernetes secret which contains the 'ldap-toml' file by running this command:
$ kubectl create secret generic grafana-ldap --from-file=./ldap-toml
LDAP integration is enabled via the 'grafana.ini' file. When using the Grafana Helm Chart, the contents of 'grafana.ini' are managed via the 'values.yaml' file.
Create the 'foxpass_values.yaml' file which will contain the LDAP configuration, and a reference to the Kubernetes secret which was created earlier:
grafana.ini: auth.ldap: enabled: true allow_sign_up: true config_file: /etc/grafana/ldap.toml ldap: existingSecret: "grafana-ldap"
When both the Kubernetes secret and Grafana Helm Chart values are created, install or upgrade Grafana with the 'helm' utility.
To create a new installation of Grafana Helm Chart, run the command:
helm install grafana stable/grafana -f foxpass_values.yaml
To upgrade an existing installation of Grafana Helm Chart, run the command:
$ helm upgrade --install grafana stable/grafana -f foxpass_values.yaml
After running the appropriate command, check the logs with 'kubectl':
$ kubectl get pod -l app=grafana NAME READY STATUS RESTARTS AGE grafana-569876bf4d-wghc8 1/1 Running 0 42m $ kubectl logs -f grafana-569876bf4d-wghc8 t=2018-08-06T13:02:43+0000 lvl=info msg="Initializing Stream Manager" t=2018-08-06T13:02:43+0000 lvl=info msg="Initializing HTTP Server" logger=http.server address=0.0.0.0:3000 protocol=http subUrl= socket=
When Grafana has started, use 'kubectl port-forward' command to validate if you're able to log in using your Foxpass credentials:
$ kubectl port-forward grafana-569876bf4d-wghc8 3000
Navigate to http://localhost:3000 and log in with your Foxpass credentials!
You can use the 'ldapsearch' CLI tool to validate your LDAP Binder credentials:
$ ldapsearch -x -H ldaps://ldap.foxpass.com -b dc=≪example≫,dc=≪com≫ -D cn=grafana,dc≪<example≫,dc=≪com≫ -W ≪binder password≫
Additionally, you can check the Foxpass LDAP Logs if you're experiencing issues while trying to log in.
Updated over 4 years ago