How do you configure Grafana authentication to go through Okta?

I've looked at a couple of different resources already, so currently what I have is an Nginx server that proxies requests to my Grafana server. However, when I try to add in reverse proxying to Okta, I get back a 500 response. I've been trying to setup Grafana's auth.proxy as well as Nginx's http_auth_proxy_request_module.

Here are my configs for grafana:


root_url = %(protocol)s://$(domain)s:/grafana


enabled = true

header_name = X-Webauth-User

header_property = username

auto_sign_up = true

Here are my configs for nginx:

server {

location /grafana {

auth_request /auth;

auth_request_set $user $upstream_http_x_user;

proxy_set_header x-user $user;

proxy_pass http://localhost:3000;

rewrite ^/grafana(.*) /$1 break;

} location /auth {

proxy_pass https://myorg.okta.com/home/app/key;

proxy_pass_request_body off;

proxy_set_header Content-Length "";

proxy_set_header X-Original_URI $request_uri;


I'm new to all of this so any tips or help and some explanations would be greatly appreciated. Cheers!

  • So what URL are you hitting? post nginx logs also when the issue happens – Tarun Lalwani Sep 28 '17 at 6:45

The simplest way to integrate Grafana with Okta is to use the Generic OAuth2.0 login module. You'll need to set up Grafana as an OpenID client "web application" in Okta. Set the Base URIs to https://<grafana domain>/ and set the Login redirect URIs to https://<grafana domain>/login/generic_oauth.

Then set up the generic oauth module in Grafana like:

name = Okta
enabled = true
scopes = openid profile email
client_id = <okta application Client ID>
client_secret = <okta application Client Secret>
auth_url = https://<okta domain>/oauth2/v1/authorize
token_url = https://<okta domain>/oauth2/v1/token
api_url = https://<okta domain>/oauth2/v1/userinfo
  • Thanks a bunch! I still have a couple questions. Firstly, do you know how to get an okta application's id and secret? I went through the admin console and created a webapp but was not able to find this info listed anywhere. Secondly, I'm not sure how to go about configuring the URIs as specified above inside of okta. I have options to set SSO, Recipient, Destination URLs and Audience Restriction, but I'm not sure how they would correspond to the Base and Login Redirect URIs you mentioned in your post. – user8685697 Sep 29 '17 at 2:29
  • Click "Applications" in the top menu, then click the "grafana" application, and go to the "General" tab. The values you want are the id and secret in the "Client Credentials" box. The "Login Redirect URIs" setting is in the "General Settings" box, I'm not sure how to change the application "Base URI" after you've created it, but I believe it's only used to provide the login link from the Okta dashboard. – AussieDan Sep 29 '17 at 8:57
  • Okay thanks! I did some digging and I think I know why I couldn't find this info before: I was trying to use a webapp with SAML whereas you were talking about a webapp with OpenID. Would you happen to know how to do this configuration if the sign-on method is SAML? Thanks so much for the help! – user8685697 Sep 29 '17 at 20:45
  • Grafana doesn't support SAML, as far as I know it should work just the same way for the end user with OpenID as it would with SAML – AussieDan Sep 30 '17 at 18:38
  • 1
    @CPA You would set it to match the url you use to access grafana – AussieDan Dec 4 '17 at 14:55

Your Answer

