Grafana SSO: one OIDC configuration for any identity provider

Grafana OSS supports generic OAuth, which means the same configuration works with Casdoor, Keycloak, Microsoft Entra ID, Okta, Google or any other OpenID Connect provider. You do not need a provider-specific plugin; you need the right callback URL, the three endpoints, the scopes and a role mapping.

This guide follows the Grafana generic OAuth settings and uses Casdoor as the example identity provider. The same steps apply to the others, with different endpoint URLs.

What you need

• A running Grafana instance with access to its configuration file.
• An identity provider where you can create an application and get a client ID and secret.
• HTTPS on both sides. If either side is HTTP, see the TLS note below.

Step 1: create the application in the IdP

Create an application for Grafana in the identity provider and add its callback URL:

Grafana's default callback path is /login/generic_oauth, so the full redirect URL is:

https://<grafana-host>/login/generic_oauth

Copy the client ID and client secret. In Casdoor, this is the application page; in Keycloak, it is a client with the same redirect URI; in Entra ID, it is an app registration with a web redirect URI.

Step 2: configure Grafana

Edit Grafana's configuration (for example conf/defaults.ini or a file under conf/), find or add the auth.generic_oauth section, and set:

[auth.generic_oauth]
name = Casdoor
icon = signin
enabled = true
allow_sign_up = true
client_id = <client ID from the IdP>
client_secret = <client secret from the IdP>
auth_url = https://<casdoor-host>/login/oauth/authorize
token_url = https://<casdoor-host>/api/login/oauth/access_token
api_url = https://<casdoor-host>/api/userinfo
scopes = openid profile email

The three endpoints come from the provider's OIDC discovery document at /.well-known/openid-configuration:

For Keycloak, the paths include the realm, for example /realms//protocol/openid-connect/auth. For Entra ID, they include the tenant ID. Always copy them from discovery rather than guessing.

Set the scopes explicitly

Grafana's default scope is user:email, which does not request an OpenID Connect ID token. Set scopes = openid profile email explicitly, or the provider may not return the claims Grafana needs.

HTTPS and root_url

If Casdoor or Grafana is not using HTTPS, Grafana can be told to skip certificate verification with tls_skip_verify_insecure = true. That is acceptable only in a test environment; fix the certificate instead.

If the post-login redirect goes to the wrong host, set root_url in the [server] section to the public URL of Grafana. Grafana builds the callback from that value, so a wrong root_url produces a redirect URI mismatch.

Step 3: map roles

Grafana can map a claim from the ID token or UserInfo response to its own roles with role_attribute_path, a JMESPath expression. The Grafana documentation shows a pattern like:

role_attribute_path = contains(roles[*].name || roles || `[]`, 'admin') && 'Admin' || contains(roles[*].name || roles || `[]`, 'editor') && 'Editor' || 'Viewer'
role_attribute_strict = true
allow_assign_grafana_admin = true

The two shapes matter. With Casdoor's default JWT token format, the ID token carries roles as objects, so the expression reads roles[*].name. With JWT-Standard, the ID token has no roles and Grafana falls back to UserInfo, where roles is a list of names; the || roles part covers that case.

If roles do not apply, check that the claim is actually present, that role_attribute_path matches its shape, and that role_attribute_strict is set if you want Grafana to reject users without a mapped role. allow_assign_grafana_admin controls whether the mapping can grant Grafana server admin.

Step 4: restart and test

Restart Grafana after changing the configuration. Open the login page; the configured provider should appear as a sign-in option. Sign in with a test user and check that the username, email and role in Grafana are what you expect.

Troubleshooting

FAQ

Does Grafana support SAML? Grafana OSS supports generic OAuth and OIDC. SAML is available through Grafana Enterprise or Grafana Cloud; for OSS, use an OIDC provider or a broker that exposes OIDC.

Can I use Grafana with several identity providers? Grafana supports one generic OAuth configuration at a time. If you need multiple providers, put an identity provider or broker in front of Grafana and let it present one OIDC connection.

Does this work with Grafana Cloud? Grafana Cloud has its own SSO configuration and does not use the local ini file. The OIDC concepts are the same, but the settings are in the Grafana Cloud portal.

How do I give a user Grafana admin rights? Map the role in role_attribute_path and allow it with allow_assign_grafana_admin. Give server admin only to a small group; Grafana admin is a powerful role.

If you need an identity provider to sit in front of Grafana and your other self-hosted tools, Casdoor is open source and supports OIDC, SAML, CAS, LDAP and SCIM. Casdoor Cloud starts at $6.67/month billed yearly for a dedicated instance. See the Casdoor Grafana guide for the exact values.