From f61e8f1f684fdef63b3efed2e4c0cfa3b9cdd546 Mon Sep 17 00:00:00 2001 From: rock Date: Tue, 15 Sep 2026 00:17:50 +0900 Subject: [PATCH] fix(grafana): use preferred_username for OAuth login lookup Reverts to standard OpenID 'preferred_username' claim which is guaranteed to be present in all userinfo responses. The 'email' claim requires explicit scope mapping in Authentik that may not be consistently returned. Authentik user 'rock' has preferred_username='rock' which matches the existing Grafana user login. --- k8s/infra/logging/grafana-values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/k8s/infra/logging/grafana-values.yaml b/k8s/infra/logging/grafana-values.yaml index 8849701..2e2d3e6 100644 --- a/k8s/infra/logging/grafana-values.yaml +++ b/k8s/infra/logging/grafana-values.yaml @@ -84,7 +84,7 @@ grafana.ini: # Authentik doesn't serve — request 404s with "Error getting email address" # and the whole OAuth login fails. email_attribute_path: email - login_attribute_path: email # Use email for lookup — stable and matches Authentik + login_attribute_path: preferred_username # Use preferred_username — OpenID standard claim, always present name_attribute_path: name role_attribute_path: "preferred_username == 'akadmin' && 'GrafanaAdmin' || contains(groups[*], 'homelab-admins') && 'Admin' || 'Viewer'" allow_assign_grafana_admin: true