Jinemi/thermograph
4
0
Fork 0
Code Issues 2 Pull requests 3 Projects Releases Packages Wiki Activity Actions

Grafana: match Google logins to pre-provisioned users by email

Browse source 
Grafana 9.3+ won't look up an OAuth login by email, so a Google sign-in for
the API-created admin (no prior Google-auth linkage) tried to auto-create the
user and hit allow_sign_up=false ("signup is disabled"). Enable
oauth_allow_insecure_email_lookup so the login matches the existing user by
its Google-verified email. Single provider + verified email = no takeover risk.
This commit is contained in:
Emi Griffith 2026-07-21 13:24:37 -07:00
parent 6137a08c23
commit dafed81f88
1 changed files with 7 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
docker-compose.yml
View file

@ -51,6 +51,13 @@ services:
GF_AUTH_GOOGLE_TOKEN_URL: "https://oauth2.googleapis.com/token" GF_AUTH_GOOGLE_TOKEN_URL: "https://oauth2.googleapis.com/token"
GF_AUTH_GOOGLE_API_URL: "https://openidconnect.googleapis.com/v1/userinfo" GF_AUTH_GOOGLE_API_URL: "https://openidconnect.googleapis.com/v1/userinfo"
GF_AUTH_GOOGLE_ALLOW_SIGN_UP: "false" GF_AUTH_GOOGLE_ALLOW_SIGN_UP: "false"
# Match a Google login to a PRE-PROVISIONED user by email (the admin created
# via the API has no prior Google-auth linkage). Without this, Grafana 9.3+
# won't look up by email and instead tries to auto-create the user — which
# allow_sign_up=false then rejects ("signup is disabled"). Safe here: Google
# verifies email ownership and it's the only OAuth provider, so there's no
# cross-provider takeover vector the "insecure" name warns about.
GF_AUTH_OAUTH_ALLOW_INSECURE_EMAIL_LOOKUP: "true"
volumes: volumes:
- ./grafana/provisioning:/etc/grafana/provisioning:ro - ./grafana/provisioning:/etc/grafana/provisioning:ro
- ./grafana/dashboards:/var/lib/grafana/dashboards:ro - ./grafana/dashboards:/var/lib/grafana/dashboards:ro