Single sign-on for Grafana

1. 1

   Register Grafana in Casdoor

   In the Casdoor console, open Applications, add an application for Grafana, and on its OIDC/OAuth tab copy the Client ID and Client secret. Add this redirect URL to Redirect URLs:

   • https://grafana.example.com/login/generic_oauth

   To use groups, create them in the application's organization (for example grafana-admins and grafana-editors) and add users. Then set Token group format to Name on the same tab, so tokens carry grafana-admins rather than <organization>/grafana-admins.

2. 2

   Configure Grafana

   Add this section to grafana.ini, or set the same keys as GF_AUTH_GENERIC_OAUTH_* environment variables. root_url must be the address people open in the browser, because Grafana builds the callback URL from it.

   [server]
   root_url = https://grafana.example.com/
   
   [auth.generic_oauth]
   enabled = true
   name = Casdoor
   client_id = <client ID>
   client_secret = <client secret>
   scopes = openid profile email
   auth_url = https://auth.example.com/login/oauth/authorize
   token_url = https://auth.example.com/api/login/oauth/access_token
   api_url = https://auth.example.com/api/userinfo
   use_pkce = true
   allow_sign_up = true
   login_attribute_path = preferred_username
   email_attribute_path = email
   groups_attribute_path = groups
   role_attribute_path = contains(groups[*], 'grafana-admins') && 'Admin' || contains(groups[*], 'grafana-editors') && 'Editor' || 'Viewer'

3. 3

   Sign in

   Restart Grafana. The login page now has a Sign in with Casdoor button. Members of grafana-admins become Admins, members of grafana-editors Editors, and everyone else a Viewer.

Grafana settings are from its documentation as of October 2026 (Grafana Generic OAuth); see also the Casdoor documentation. Grafana is a trademark of its owner.