Merge "grafana: Add LDAP authentication support"

1 files changed, 49 insertions, 0 deletions

diff --git a/doc/source/reference/logging-and-monitoring/grafana-guide.rst b/doc/source/reference/logging-and-monitoring/grafana-guide.rst
index 8622b8e99..6f89c2016 100644
--- a/doc/source/reference/logging-and-monitoring/grafana-guide.rst
+++ b/doc/source/reference/logging-and-monitoring/grafana-guide.rst
@@ -30,6 +30,55 @@ If you would like to set up Prometheus as a data source, additionally set:
 
 Please follow :doc:`Prometheus Guide <prometheus-guide>` for more information.
 
+LDAP Authentication
+~~~~~~~~~~~~~~~~~~~
+
+Grafana can be configured to use LDAP for user authentication. To enable this
+feature, set the following variable in ``/etc/kolla/globals.yml``:
+
+.. code-block:: yaml
+
+   grafana_ldap_enabled: true
+
+The configuration for the LDAP server should be provided in a ``ldap.toml``
+file placed in the ``{{ node_custom_config }}/grafana/`` folder on the control
+host.
+
+Example ``ldap.toml`` configuration:
+
+.. code-block:: ini
+
+   [[servers]]
+   host = "openstack.org"
+   port = 389
+   use_ssl = false
+   start_tls = true
+
+   bind_dn = "CN=svc-openstack-grafana,OU=serviceaccounts,DC=openstack,DC=org"
+   bind_password = "strong_password"
+
+   search_filter = "(sAMAccountName=%s)"
+   search_base_dns = ["OU=Users,DC=openstack,DC=org"]
+
+   [servers.attributes]
+   name = "givenName"
+   surname = "sn"
+   username = "uid"
+   member_of = "memberOf"
+   email = "mail"
+
+   [[servers.group_mappings]]
+   group_dn = "cn=grafana-admins,ou=groups,dc=openstack,dc=org"
+   org_role = "Admin"
+
+   [[servers.group_mappings]]
+   group_dn = "cn=grafana-editors,ou=groups,dc=openstack,dc=org"
+   org_role = "Editor"
+
+   [[servers.group_mappings]]
+   group_dn = "*"
+   org_role = "Viewer"
+
 Custom dashboards provisioning
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~