From f10f0a8a26b4aba61346f43ed175abd0239159fd Mon Sep 17 00:00:00 2001 From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com> Date: Wed, 12 Aug 2026 16:46:57 -0700 Subject: [PATCH] =?UTF-8?q?fix(grafana):=20add=20email/login/name=5Fattrib?= =?UTF-8?q?ute=5Fpath=20for=20Authentik=20OIDC=20=E2=80=94=20Grafana=20was?= =?UTF-8?q?=20falling=20back=20to=20GitHub-style=20/emails=20(4?= =?UTF-8?q?04=20'Error=20getting=20email=20address'),=20breaking=20OAuth?= =?UTF-8?q?=20login;=20read=20identity=20from=20userinfo=20claims=20instea?= =?UTF-8?q?d?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- k8s/infra/logging/grafana-values.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/k8s/infra/logging/grafana-values.yaml b/k8s/infra/logging/grafana-values.yaml index 634fa2f..59dc0e8 100644 --- a/k8s/infra/logging/grafana-values.yaml +++ b/k8s/infra/logging/grafana-values.yaml @@ -76,6 +76,13 @@ grafana.ini: auth_url: https://authentik.riotpiao.com/application/o/authorize/ token_url: https://authentik.riotpiao.com/application/o/token/ api_url: https://authentik.riotpiao.com/application/o/userinfo/ + # Read identity straight from the userinfo/id_token claims. Without these, + # Grafana falls back to the GitHub-style "/emails" call, which + # Authentik doesn't serve — request 404s with "Error getting email address" + # and the whole OAuth login fails. + email_attribute_path: email + login_attribute_path: preferred_username + name_attribute_path: name role_attribute_path: "contains(groups[*], 'grafana-admins') && 'Admin' || 'Viewer'" use_pkce: false use_refresh_token: false