From 219827f7dc1f4d1b27e8abb172180deaf40d5d97 Mon Sep 17 00:00:00 2001 From: Piotr Milewski Date: Tue, 10 Mar 2026 14:52:07 +0100 Subject: grafana: Add LDAP authentication support This commit adds the ability to enable and configure LDAP authentication for Grafana. It introduces a new variable 'grafana_ldap_enabled' and automates the process of copying the 'ldap.toml' configuration file and updating 'grafana.ini'. Change-Id: I1f9de8202629904757840f5b2b5d0b8429e42f96 Signed-off-by: Piotr Milewski --- .../logging-and-monitoring/grafana-guide.rst | 49 ++++++++++++++++++++++ 1 file changed, 49 insertions(+) (limited to 'doc') diff --git a/doc/source/reference/logging-and-monitoring/grafana-guide.rst b/doc/source/reference/logging-and-monitoring/grafana-guide.rst index 12f123a20..cafdf3943 100644 --- a/doc/source/reference/logging-and-monitoring/grafana-guide.rst +++ b/doc/source/reference/logging-and-monitoring/grafana-guide.rst @@ -30,6 +30,55 @@ If you would like to set up Prometheus as a data source, additionally set: Please follow :doc:`Prometheus Guide ` for more information. +LDAP Authentication +~~~~~~~~~~~~~~~~~~~ + +Grafana can be configured to use LDAP for user authentication. To enable this +feature, set the following variable in ``/etc/kolla/globals.yml``: + +.. code-block:: yaml + + grafana_ldap_enabled: true + +The configuration for the LDAP server should be provided in a ``ldap.toml`` +file placed in the ``{{ node_custom_config }}/grafana/`` folder on the control +host. + +Example ``ldap.toml`` configuration: + +.. code-block:: ini + + [[servers]] + host = "openstack.org" + port = 389 + use_ssl = false + start_tls = true + + bind_dn = "CN=svc-openstack-grafana,OU=serviceaccounts,DC=openstack,DC=org" + bind_password = "strong_password" + + search_filter = "(sAMAccountName=%s)" + search_base_dns = ["OU=Users,DC=openstack,DC=org"] + + [servers.attributes] + name = "givenName" + surname = "sn" + username = "uid" + member_of = "memberOf" + email = "mail" + + [[servers.group_mappings]] + group_dn = "cn=grafana-admins,ou=groups,dc=openstack,dc=org" + org_role = "Admin" + + [[servers.group_mappings]] + group_dn = "cn=grafana-editors,ou=groups,dc=openstack,dc=org" + org_role = "Editor" + + [[servers.group_mappings]] + group_dn = "*" + org_role = "Viewer" + Custom dashboards provisioning ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- cgit v1.2.3