From 467b3441c9ea718bc7b3c122a4cbfad6dcc6a7b6 Mon Sep 17 00:00:00 2001 From: rock Date: Tue, 15 Sep 2026 00:01:10 +0900 Subject: [PATCH] fix(grafana): use email for OAuth login lookup instead of preferred_username - Change login_attribute_path from preferred_username to email for stable user matching - Enable allow_sign_up to permit OAuth user sync with existing local users - Root cause: Authentik's 'rock' user matches existing Grafana 'rock' by email, not by preferred_username claim --- k8s/infra/logging/grafana-values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/k8s/infra/logging/grafana-values.yaml b/k8s/infra/logging/grafana-values.yaml index 17079e9..8849701 100644 --- a/k8s/infra/logging/grafana-values.yaml +++ b/k8s/infra/logging/grafana-values.yaml @@ -73,7 +73,7 @@ grafana.ini: auth.generic_oauth: enabled: true name: Authentik - allow_sign_up: false + allow_sign_up: true # Allow sync to create/update users from OAuth claims client_id: grafana scopes: openid email profile groups auth_url: https://authentik.riotpiao.com/application/o/authorize/ @@ -84,7 +84,7 @@ grafana.ini: # Authentik doesn't serve — request 404s with "Error getting email address" # and the whole OAuth login fails. email_attribute_path: email - login_attribute_path: preferred_username + login_attribute_path: email # Use email for lookup — stable and matches Authentik name_attribute_path: name role_attribute_path: "preferred_username == 'akadmin' && 'GrafanaAdmin' || contains(groups[*], 'homelab-admins') && 'Admin' || 'Viewer'" allow_assign_grafana_admin: true