### Grafana SSO (Kerberos via Prole auth)

This repo’s first-pass Grafana SSO is implemented as:

1. Users authenticate at `https://api.prole.org/auth/login`.
   - Primary: Kerberos/SPNEGO (`/auth/spnego`)
   - Fallback: form login (`/auth/form`) only when explicitly enabled
2. On success, `prole-auth` issues a signed session cookie scoped to `Domain=.prole.org`.
3. Users access Grafana at `https://svc.prole.org/` as usual.
4. `svc.prole.org` is routed to an internal Nginx `prole-grafana-proxy` service.
   - The proxy calls `prole-auth` (`/auth/verify`) via `auth_request` on every request.
   - On success it injects `X-WEBAUTH-USER` and forwards to Grafana.
   - On failure it redirects to `https://api.prole.org/auth/login?next=...` (fail-closed).
5. Grafana is configured with `auth.proxy` to trust `X-WEBAUTH-USER`.

#### Key configuration knobs

- Kong routing + TLS:
  - `SERVICE_HOSTNAME` (default `svc.prole.org`)
  - `AUTH_HOSTNAME` (default `api.prole.org`)
  - `PROLE_GRAFANA_SSO_ENABLED=1` to route `svc.prole.org` → `prole-grafana-proxy` instead of directly to Grafana

- Grafana chart values:
  - `PROLE_GRAFANA_SSO_ENABLED=1` enables `grafana.ini.auth.proxy` and disables the Grafana login form / anonymous access

- `prole-auth` service (environment variables):
  - `PROLE_AUTH_ENABLED=true`
  - `PROLE_AUTH_SESSION_SECRET` (required; strong random)
  - `PROLE_AUTH_COOKIE_DOMAIN=.prole.org`
  - `PROLE_KERBEROS_SERVICE_PRINCIPAL` (required for SPNEGO)
  - `PROLE_KERBEROS_KEYTAB_PATH` (required for SPNEGO)
  - `PROLE_AUTH_FORM_ENABLED=true` (optional; enables password fallback)

#### Kubernetes resources

Manifests are under `deploy/opentofu/k3s/manifests/prole/`:

- `prole-auth-deployment.yaml` / `prole-auth-service.yaml`
- `prole-kdc-configmap.yaml` (embedded KDC sidecar configuration)
- `grafana-proxy-configmap.yaml` / `grafana-proxy-deployment.yaml` / `grafana-proxy-service.yaml`

Required (provided externally):

- Secret `prole-auth-secrets` with key `sessionSecret`
- Secret `prole-auth-keytab` containing the HTTP service keytab at `http.keytab`
- Secret `prole-kdc-secrets` with keys `master_password` and `admin_password` (for the embedded KDC)

#### Logout / session invalidation

- `GET /auth/logout` clears the Prole session cookie (`Max-Age=0`).
- Grafana access is effectively revoked on the next request because the proxy calls `/auth/verify` for every request.