Merge "grafana: Add LDAP authentication support"

6 files changed, 82 insertions, 1 deletions

diff --git a/ansible/group_vars/all/grafana.yml b/ansible/group_vars/all/grafana.yml
index 15f430114..470ac1669 100644
--- a/ansible/group_vars/all/grafana.yml
+++ b/ansible/group_vars/all/grafana.yml
@@ -9,3 +9,5 @@ grafana_public_endpoint: "{{ grafana_external_fqdn | kolla_url(public_protocol,
 grafana_server_port: "3000"
 grafana_server_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else grafana_server_port }}"
 grafana_server_listen_port: "{{ grafana_server_port }}"
+
+grafana_ldap_enabled: false
diff --git a/ansible/roles/grafana/tasks/config.yml b/ansible/roles/grafana/tasks/config.yml
index 9a5ee7dbe..f2852820d 100644
--- a/ansible/roles/grafana/tasks/config.yml
+++ b/ansible/roles/grafana/tasks/config.yml
@@ -46,6 +46,15 @@
   become: true
   with_dict: "{{ grafana_services | select_services_enabled_and_mapped_to_host }}"
 
+- name: Copying over ldap.toml
+  template:
+    src: "{{ node_custom_config }}/grafana/ldap.toml"
+    dest: "{{ node_config_directory }}/grafana/ldap.toml"
+    mode: "0660"
+  become: true
+  when:
+    - grafana_ldap_enabled | bool
+
 - name: Copying over extra configuration file
   become: true
   template:
diff --git a/ansible/roles/grafana/templates/grafana.ini.j2 b/ansible/roles/grafana/templates/grafana.ini.j2
index 1b46f18a4..763915796 100644
--- a/ansible/roles/grafana/templates/grafana.ini.j2
+++ b/ansible/roles/grafana/templates/grafana.ini.j2
@@ -34,3 +34,10 @@ admin_password = {{ grafana_admin_password }}
 [plugins]
 plugin_admin_enabled = false
 public_key_retrieval_disabled = true
+
+{% if grafana_ldap_enabled | bool %}
+[auth.ldap]
+enabled = true
+config_file = /etc/grafana/ldap.toml
+allow_sign_up = true
+{% endif %}
diff --git a/ansible/roles/grafana/templates/grafana.json.j2 b/ansible/roles/grafana/templates/grafana.json.j2
index b98c53c79..a9d6445bf 100644
--- a/ansible/roles/grafana/templates/grafana.json.j2
+++ b/ansible/roles/grafana/templates/grafana.json.j2
@@ -42,7 +42,14 @@
             "owner": "grafana",
             "perm": "0755",
             "optional": true
-        }{% if kolla_copy_ca_into_containers | bool %},
+        }{% if grafana_ldap_enabled | bool %},
+        {
+            "source": "{{ container_config_directory }}/ldap.toml",
+            "dest": "/etc/grafana/ldap.toml",
+            "owner": "grafana",
+            "perm": "0600"
+        }{% endif %}
+        {% if kolla_copy_ca_into_containers | bool %},
         {
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
diff --git a/doc/source/reference/logging-and-monitoring/grafana-guide.rst b/doc/source/reference/logging-and-monitoring/grafana-guide.rst
index 8622b8e99..6f89c2016 100644
--- a/doc/source/reference/logging-and-monitoring/grafana-guide.rst
+++ b/doc/source/reference/logging-and-monitoring/grafana-guide.rst
@@ -30,6 +30,55 @@ If you would like to set up Prometheus as a data source, additionally set:
 
 Please follow :doc:`Prometheus Guide <prometheus-guide>` for more information.
 
+LDAP Authentication
+~~~~~~~~~~~~~~~~~~~
+
+Grafana can be configured to use LDAP for user authentication. To enable this
+feature, set the following variable in ``/etc/kolla/globals.yml``:
+
+.. code-block:: yaml
+
+   grafana_ldap_enabled: true
+
+The configuration for the LDAP server should be provided in a ``ldap.toml``
+file placed in the ``{{ node_custom_config }}/grafana/`` folder on the control
+host.
+
+Example ``ldap.toml`` configuration:
+
+.. code-block:: ini
+
+   [[servers]]
+   host = "openstack.org"
+   port = 389
+   use_ssl = false
+   start_tls = true
+
+   bind_dn = "CN=svc-openstack-grafana,OU=serviceaccounts,DC=openstack,DC=org"
+   bind_password = "strong_password"
+
+   search_filter = "(sAMAccountName=%s)"
+   search_base_dns = ["OU=Users,DC=openstack,DC=org"]
+
+   [servers.attributes]
+   name = "givenName"
+   surname = "sn"
+   username = "uid"
+   member_of = "memberOf"
+   email = "mail"
+
+   [[servers.group_mappings]]
+   group_dn = "cn=grafana-admins,ou=groups,dc=openstack,dc=org"
+   org_role = "Admin"
+
+   [[servers.group_mappings]]
+   group_dn = "cn=grafana-editors,ou=groups,dc=openstack,dc=org"
+   org_role = "Editor"
+
+   [[servers.group_mappings]]
+   group_dn = "*"
+   org_role = "Viewer"
+
 Custom dashboards provisioning
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
diff --git a/releasenotes/notes/add-grafana-ldap-support-65197904c0c325d1.yaml b/releasenotes/notes/add-grafana-ldap-support-65197904c0c325d1.yaml
new file mode 100644
index 000000000..df605bc7e
--- /dev/null
+++ b/releasenotes/notes/add-grafana-ldap-support-65197904c0c325d1.yaml
@@ -0,0 +1,7 @@
+---
+features:
+  - |
+    Adds support for LDAP authentication in Grafana.
+    Users can now enable LDAP by setting ``grafana_ldap_enabled`` to
+    ``true`` and providing an ``ldap.toml`` configuration file in the
+    ``{{ node_custom_config }}/grafana/`` directory.