Grafana Openid Connect
You set up grafana openid connect by linking your login provider to your dashboard server. This setup lets users log in with their main work accounts and removes local passwords. Most teams create a new client app in their identity tool and copy the secret keys over. Then they map group names to dashboard roles like viewer, editor, or admin. When teams grant broad roles to save time, users gain too much power over data sources. How the grafana openid connect login flow works The login flow st
OpenID Connect (OIDC) + Grafana Access Control: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up grafana openid connect by linking your login provider to your dashboard server. This setup lets users log in with their main work accounts and removes local passwords. Most teams create a new client app in their identity tool and copy the secret keys over. Then they map group names to dashboard roles like viewer, editor, or admin. When teams grant broad roles to save time, users gain too much power over data sources.
How the grafana openid connect login flow works
The login flow starts when a user clicks the single sign-on button on the login page. The dashboard server sends the user's browser to your central identity provider. The user logs in there and proves their identity with a password or hardware key. Next, the identity provider sends an authorization code back to the user's browser. The dashboard server trades this code for an identity token and an access token. The server reads the token claims to find the user's email and group list. Your server settings match those group names to built-in dashboard roles. If a group matches the admin rule, the user gets full control right away. If no group matches, the server can assign a basic viewer role or block the login. Every time the user logs in, the server checks the fresh token and updates their role.
Why role mapping is hard to manage at scale
Role mapping works well when you only have a few teams and simple dashboards. As your company grows, engineering teams add dozens of new databases and log stores. Built-in roles apply across the whole workspace or folder, not to single database queries. An editor can often write raw queries against any data source linked to their team space. If that data source connects to a production database, any editor can run heavy queries. They can also query tables that hold private user data like emails and phone numbers. Teams try to fix this by creating separate spaces for each group. That choice creates extra work because admins must manage many login rules and duplicate dashboards. Soon, nobody knows which group can read which database table.
What login controls solve and what they leave open
Central login controls solve the problem of weak passwords and leftover accounts. When an employee leaves the company, you disable their main account in one place. They lose access to dashboards right away without manual cleanup on the server. Still, login checks only decide who can enter the app at the start of a session. They do not check what the dashboard or the user does after login. The dashboard server uses shared database accounts to run queries for everyone in that space. Your database logs only show the shared dashboard account, not the person who clicked the chart. Also, login tokens cannot stop a user from pulling customer card numbers or national IDs. To protect raw data, you need controls that inspect queries and rewrite sensitive fields in results.
OpenID Connect (OIDC) + Grafana Access Control: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev runs beside those services as an open-source proxy, a sidecar for your Postgres or API. It inspects requests coming in and results going back on the wire.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run. On responses, hoop.dev data masking rewrites matched sensitive values in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
What happens when a user's group changes in the identity provider?
The dashboard server updates the user's role the next time they log in and fetch a new token. Until the current session ends, the user keeps their old role and permissions.
Can I block users who do not belong to any mapped group?
Yes, you can configure the server to deny login if the token lacks a matching group claim. This rule stops unassigned staff from getting a default viewer role by mistake.
Does single sign-on hide sensitive data inside dashboard panels?
No, single sign-on only checks who can log in and which folders they can open. Every user with view rights on a panel sees the exact same query results.