mirror of https://github.com/grafana/grafana
Add multi-auth devenv (#57609)
* add authentik devenv * remove direct dependency on spew * use cn * add authentik instructions * add backup instructionspull/57571/head
Jo
3 years ago
committed by
GitHub
parent
92531c5596
commit
77437f2c89
@ -0,0 +1,67 @@ |
||||
# Authentik block |
||||
|
||||
Authentik is an open source idP that supports LDAP, SAML, OAuth. |
||||
|
||||
Useful for testing a second implementation |
||||
|
||||
## Currently configured in DB and instructions |
||||
|
||||
- [x] LDAP |
||||
- [ ] SAML |
||||
- [ ] OAuth |
||||
|
||||
## Deployment |
||||
|
||||
First build and deploy the `openldap` container. |
||||
|
||||
```bash |
||||
make devenv sources=auth/authentik |
||||
``` |
||||
|
||||
### Exposed ports |
||||
|
||||
The container will expose port `3389` and `6636` as LDAP and LDAPS. |
||||
|
||||
The container will expose port `9000` for API and Admin interface. |
||||
|
||||
|
||||
## LDAP Setup |
||||
|
||||
The following changes are needed at Grafana's configuration file. |
||||
|
||||
```ini |
||||
[auth.ldap] |
||||
enabled = true |
||||
config_file = devenv/docker/blocks/auth/authentik/ldap_authentik.toml |
||||
|
||||
sync_cron = "* * * * 1" |
||||
active_sync_enabled = true |
||||
``` |
||||
|
||||
## Available users and groups |
||||
|
||||
*authentik admin*: |
||||
|
||||
- username: akadmin |
||||
- email: admin@localhost |
||||
- password: admin |
||||
|
||||
*grafana logins*: |
||||
|
||||
- username: authentik-admin |
||||
- password: grafana |
||||
|
||||
- username: authentik-editor |
||||
- password: grafana |
||||
|
||||
- username: authentik-viewer |
||||
- password: grafana |
||||
|
||||
## Backing up DB |
||||
|
||||
In case you want to make changes to the devenv setup, you can dump keycloak's DB: |
||||
|
||||
```bash |
||||
cd devenv; |
||||
docker-compose exec -T authentikdb bash -c "pg_dump -U authentik authentik" > docker/blocks/auth/authentik/cloak.sql |
||||
``` |
||||
File diff suppressed because one or more lines are too long
@ -0,0 +1,91 @@ |
||||
authentikdb: |
||||
image: docker.io/library/postgres:12-alpine |
||||
restart: unless-stopped |
||||
container_name: authentikdb |
||||
environment: |
||||
POSTGRES_DB: authentik |
||||
POSTGRES_USER: authentik |
||||
POSTGRES_PASSWORD: authentik |
||||
volumes: |
||||
- ./docker/blocks/auth/authentik/cloak.sql:/docker-entrypoint-initdb.d/cloak.sql |
||||
healthcheck: |
||||
test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"] |
||||
start_period: 20s |
||||
interval: 30s |
||||
retries: 5 |
||||
timeout: 5s |
||||
|
||||
authentikredis: |
||||
image: docker.io/library/redis:alpine |
||||
restart: unless-stopped |
||||
command: --save 60 1 --loglevel warning |
||||
healthcheck: |
||||
test: ["CMD-SHELL", "redis-cli ping | grep PONG"] |
||||
start_period: 20s |
||||
interval: 30s |
||||
retries: 5 |
||||
timeout: 3s |
||||
|
||||
authentik_ldap: |
||||
image: ghcr.io/goauthentik/ldap |
||||
ports: |
||||
- 3389:3389 |
||||
- 6636:6636 |
||||
environment: |
||||
AUTHENTIK_HOST: http://authentik:9000 |
||||
AUTHENTIK_INSECURE: "true" |
||||
AUTHENTIK_TOKEN: 77vDKwFWqCAsD9ykbH6vsGuMHtloM6urfeglrR9KRhWFcABtwmGGiQWHQStw |
||||
links: |
||||
- "authentik:authentik" |
||||
|
||||
authentik: |
||||
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2022.10.0} |
||||
restart: unless-stopped |
||||
container_name: authentik |
||||
command: server |
||||
environment: |
||||
AUTHENTIK_SECRET_KEY: FA8GANUqMJwFg0drDlurF+ZQK2A6ohSjc4MGksUqN+A36yIA |
||||
AUTHENTIK_REDIS__HOST: authentikredis |
||||
AUTHENTIK_POSTGRESQL__HOST: authentikdb |
||||
AUTHENTIK_POSTGRESQL__USER: authentik |
||||
AUTHENTIK_POSTGRESQL__NAME: authentik |
||||
AUTHENTIK_POSTGRESQL__PASSWORD: authentik |
||||
AUTHENTIK_ERROR_REPORTING__ENABLED: "true" |
||||
ports: |
||||
- 9000:9000 |
||||
depends_on: |
||||
- authentikdb |
||||
- authentikredis |
||||
volumes: |
||||
- ./media:/media |
||||
- ./certs:/certs |
||||
- ./custom-templates:/templates |
||||
- ./geoip:/geoip |
||||
links: |
||||
- "authentikdb:authentikdb" |
||||
- "authentikredis:authentikredis" |
||||
|
||||
authentik-worker: |
||||
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2022.10.0} |
||||
restart: unless-stopped |
||||
container_name: authentik-worker |
||||
command: worker |
||||
environment: |
||||
AUTHENTIK_SECRET_KEY: FA8GANUqMJwFg0drDlurF+ZQK2A6ohSjc4MGksUqN+A36yIA |
||||
AUTHENTIK_REDIS__HOST: authentikredis |
||||
AUTHENTIK_POSTGRESQL__HOST: authentikdb |
||||
AUTHENTIK_POSTGRESQL__USER: authentik |
||||
AUTHENTIK_POSTGRESQL__NAME: authentik |
||||
AUTHENTIK_POSTGRESQL__PASSWORD: authentik |
||||
AUTHENTIK_ERROR_REPORTING__ENABLED: "true" |
||||
depends_on: |
||||
- authentikdb |
||||
- authentikredis |
||||
volumes: |
||||
- ./media:/media |
||||
- ./certs:/certs |
||||
- ./custom-templates:/templates |
||||
- ./geoip:/geoip |
||||
links: |
||||
- "authentikdb:authentikdb" |
||||
- "authentikredis:authentikredis" |
||||
@ -0,0 +1,38 @@ |
||||
[[servers]] |
||||
host = "127.0.0.1" |
||||
port = 3389 |
||||
use_ssl = false |
||||
start_tls = false |
||||
ssl_skip_verify = true |
||||
|
||||
bind_dn = "cn=ldapservice,ou=users,dc=ldap,dc=goauthentik,dc=io" |
||||
bind_password = 'grafana' |
||||
timeout = 10 |
||||
|
||||
search_filter = "(cn=%s)" |
||||
search_base_dns = ["DC=ldap,DC=goauthentik,DC=io"] |
||||
|
||||
# Specify names of the ldap attributes your ldap uses |
||||
[servers.attributes] |
||||
name = "displayName" |
||||
surname = "sn" |
||||
username = "cn" |
||||
member_of = "memberOf" |
||||
email = "mail" |
||||
|
||||
# Map ldap groups to grafana org roles |
||||
[[servers.group_mappings]] |
||||
group_dn = "cn=admin,ou=groups,dc=ldap,dc=goauthentik,dc=io" |
||||
org_role = "Admin" |
||||
org_id = 1 |
||||
|
||||
|
||||
[[servers.group_mappings]] |
||||
group_dn = "cn=editor,ou=groups,dc=ldap,dc=goauthentik,dc=io" |
||||
org_role = "Editor" |
||||
org_id = 1 |
||||
|
||||
[[servers.group_mappings]] |
||||
group_dn = "cn=viewer,ou=groups,dc=ldap,dc=goauthentik,dc=io" |
||||
org_role = "Viewer" |
||||
org_id = 1 |
||||
@ -1,2 +1,2 @@ |
||||
version: "2.1" |
||||
version: "3.4" |
||||
services: |
||||
|
||||
Loading…
Reference in new issue