Grafana 单点登录

用 Casdoor 配置 Grafana

1. 1

   在 Casdoor 中注册 Grafana

   在 Casdoor 控制台打开 应用，为 Grafana 添加一个应用，在它的 OIDC/OAuth 标签页复制 客户端ID 和 客户端密钥。把下面的地址加到 重定向URLs：

   • https://grafana.example.com/login/generic_oauth

   要用群组的话，先在应用所属的组织里创建群组（例如 grafana-admins and grafana-editors）并加入用户，再在同一个标签页把 Token 中的群组格式 设成 Name，这样令牌里是 grafana-admins，而不是 <组织>/grafana-admins。

2. 2

   Configure Grafana

   Add this section to grafana.ini, or set the same keys as GF_AUTH_GENERIC_OAUTH_* environment variables. root_url must be the address people open in the browser, because Grafana builds the callback URL from it.

   [server]
   root_url = https://grafana.example.com/
   
   [auth.generic_oauth]
   enabled = true
   name = Casdoor
   client_id = <client ID>
   client_secret = <client secret>
   scopes = openid profile email
   auth_url = https://auth.example.com/login/oauth/authorize
   token_url = https://auth.example.com/api/login/oauth/access_token
   api_url = https://auth.example.com/api/userinfo
   use_pkce = true
   allow_sign_up = true
   login_attribute_path = preferred_username
   email_attribute_path = email
   groups_attribute_path = groups
   role_attribute_path = contains(groups[*], 'grafana-admins') && 'Admin' || contains(groups[*], 'grafana-editors') && 'Editor' || 'Viewer'

3. 3

   Sign in

   Restart Grafana. The login page now has a Sign in with Casdoor button. Members of grafana-admins become Admins, members of grafana-editors Editors, and everyone else a Viewer.

Grafana 的设置取自它的官方文档（核对于 2026年10月：Grafana Generic OAuth）；另见Casdoor 文档。Grafana 是其所有者的商标。