chrisfu/prole
1
0
Fork 0
mirror of https://github.com/dredx/prole.git synced 2026-09-23 12:03:59 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
2e517686a8
prole/docs/grafana-sso.md
chrisfu 4ee2b259c9 Checkpoint: rename installer to knoe + harden db build context 
- Add build-context helper to copy Docker context safely (ignore runtime data, keep symlinks)

- Update UI and core actions to use ~/.prole/build and shared copy helper

- Add/adjust tests and scripts; introduce knoe ops helpers and update manifests

Co-authored-by: Junie <junie@jetbrains.com>
2026-03-22 01:45:21 -07:00

2.4 KiB
Raw Blame History

Grafana SSO (Kerberos via Prole auth)

This repo’s first-pass Grafana SSO is implemented as:

  1. Users authenticate at https://api.prole.org/auth/login.
    • Primary: Kerberos/SPNEGO (/auth/spnego)
    • Fallback: form login (/auth/form) only when explicitly enabled
  2. On success, prole-auth issues a signed session cookie scoped to Domain=.prole.org.
  3. Users access Grafana at https://svc.prole.org/ as usual.
  4. svc.prole.org is routed to an internal Nginx prole-grafana-proxy service.
    • The proxy calls prole-auth (/auth/verify) via auth_request on every request.
    • On success it injects X-WEBAUTH-USER and forwards to Grafana.
    • On failure it redirects to https://api.prole.org/auth/login?next=... (fail-closed).
  5. Grafana is configured with auth.proxy to trust X-WEBAUTH-USER.

Key configuration knobs

  • Kong routing + TLS:

    • SERVICE_HOSTNAME (default svc.prole.org)
    • AUTH_HOSTNAME (default api.prole.org)
    • PROLE_GRAFANA_SSO_ENABLED=1 to route svc.prole.org → prole-grafana-proxy instead of directly to Grafana

  • Grafana chart values:

    • PROLE_GRAFANA_SSO_ENABLED=1 enables grafana.ini.auth.proxy and disables the Grafana login form / anonymous access

  • prole-auth service (environment variables):

    • PROLE_AUTH_ENABLED=true
    • PROLE_AUTH_SESSION_SECRET (required; strong random)
    • PROLE_AUTH_COOKIE_DOMAIN=.prole.org
    • PROLE_KERBEROS_SERVICE_PRINCIPAL (required for SPNEGO)
    • PROLE_KERBEROS_KEYTAB_PATH (required for SPNEGO)
    • PROLE_AUTH_FORM_ENABLED=true (optional; enables password fallback)

Kubernetes resources

Manifests are under deploy/opentofu/k3s/manifests/prole/:

  • prole-auth-deployment.yaml / prole-auth-service.yaml
  • prole-kdc-configmap.yaml (embedded KDC sidecar configuration)
  • grafana-proxy-configmap.yaml / grafana-proxy-deployment.yaml / grafana-proxy-service.yaml

Required (provided externally):

  • Secret prole-auth-secrets with key sessionSecret
  • Secret prole-auth-keytab containing the HTTP service keytab at http.keytab
  • Secret prole-kdc-secrets with keys master_password and admin_password (for the embedded KDC)

Logout / session invalidation

  • GET /auth/logout clears the Prole session cookie (Max-Age=0).
  • Grafana access is effectively revoked on the next request because the proxy calls /auth/verify for every request.