riotpiao-poimen/homelab
2
0
Fork 0
Code Issues 23 Pull Requests Actions Packages Projects 1 Releases Wiki Activity

fix(grafana): use preferred_username for OAuth login lookup

Browse Source 
Reverts to standard OpenID 'preferred_username' claim which is guaranteed to be present in all userinfo responses. The 'email' claim requires explicit scope mapping in Authentik that may not be consistently returned.

Authentik user 'rock' has preferred_username='rock' which matches the existing Grafana user login.
This commit is contained in:
rock
2026-09-15 00:17:50 +09:00
parent 7016f764e6
commit f61e8f1f68
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
k8s/infra/logging/grafana-values.yaml
+1 -1
View File
@@ -84,7 +84,7 @@ grafana.ini:
# Authentik doesn't serve — request 404s with "Error getting email address"
# and the whole OAuth login fails.
email_attribute_path: email
login_attribute_path: email # Use email for lookup — stable and matches Authentik
login_attribute_path: preferred_username # Use preferred_username — OpenID standard claim, always present
name_attribute_path: name
role_attribute_path: "preferred_username == 'akadmin' && 'GrafanaAdmin' || contains(groups[*], 'homelab-admins') && 'Admin' || 'Viewer'"
allow_assign_grafana_admin: true