Skip to content
This repository was archived by the owner on May 31, 2023. It is now read-only.

Commit f5b6427

Browse files
paulfantompaulfantom
authored
Merge pull request #65 from idolactivities/feature/ldap
[minor] Add LDAP configuration tasks
2 parents 5b8b678 + 927f37e commit f5b6427

File tree

7 files changed

+141
-6
lines changed

7 files changed

+141
-6
lines changed

‎README.md‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -31,16 +31,17 @@ All variables which can be overridden are stored in [defaults/main.yml](defaults
3131
| `grafana_port` | 3000 | port on which grafana listens |
3232
| `grafana_url` | "http://{{ grafana_address }}:{{ grafana_port }}" | Full URL used to access Grafana from a web browser |
3333
| `grafana_domain` | "{{ ansible_fqdn \| default(ansible_host) \| default('localhost') }}" | setting is only used in as a part of the `root_url` option. Useful when using GitHub or Google OAuth |
34-
| `grafana_server` | { protocol: http, enforce_domain: false, socket: "", cert_key: "", cert_file: "", enable_gzip: False, static_root_path: public, router_logging: false } | [server](http://docs.grafana.org/installation/configuration/#server) configuration section |
34+
| `grafana_server` | { protocol: http, enforce_domain: false, socket: "", cert_key: "", cert_file: "", enable_gzip: false, static_root_path: public, router_logging: false } | [server](http://docs.grafana.org/installation/configuration/#server) configuration section |
3535
| `grafana_security` | { admin_user: admin, admin_password: "" } | [security](http://docs.grafana.org/installation/configuration/#security) configuration section |
3636
| `grafana_database` | { type: sqlite3 } | [database](http://docs.grafana.org/installation/configuration/#database) configuration section |
37-
| `grafana_welcome_email_on_sign_up` | False | Send welcome email after signing up |
38-
| `grafana_users` | { allow_sign_up: False, auto_assign_org_role: Viewer, default_theme: dark } | [users](http://docs.grafana.org/installation/configuration/#users) configuration section |
37+
| `grafana_welcome_email_on_sign_up` | false | Send welcome email after signing up |
38+
| `grafana_users` | { allow_sign_up: false, auto_assign_org_role: Viewer, default_theme: dark } | [users](http://docs.grafana.org/installation/configuration/#users) configuration section |
3939
| `grafana_auth` | {} | [authorization](http://docs.grafana.org/installation/configuration/#auth) configuration section |
40+
| `grafana_ldap` | {} | [ldap](http://docs.grafana.org/installation/ldap/) configuration section. group_mappings are expanded, see defaults for example |
4041
| `grafana_session` | {} | [session](http://docs.grafana.org/installation/configuration/#session) management configuration section |
4142
| `grafana_analytics` | {} | Google [analytics](http://docs.grafana.org/installation/configuration/#analytics) configuration section |
4243
| `grafana_smtp` | {} | [smtp](http://docs.grafana.org/installation/configuration/#smtp) configuration section |
43-
| `grafana_alerting` | True | [alerting](http://docs.grafana.org/installation/configuration/#alerting) configuration section |
44+
| `grafana_alerting` | true | [alerting](http://docs.grafana.org/installation/configuration/#alerting) configuration section |
4445
| `grafana_metrics` | {} | [metrics](http://docs.grafana.org/installation/configuration/#metrics) configuration section |
4546
| `grafana_tracing` | {} | [tracing](http://docs.grafana.org/installation/configuration/#tracing) configuration section |
4647
| `grafana_snapshots` | {} | [snapshots](http://docs.grafana.org/installation/configuration/#snapshots) configuration section |

‎defaults/main.yml‎

Lines changed: 40 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,9 +73,48 @@ grafana_auth: {}
7373
# org_role: Viewer
7474
# ldap:
7575
# config_file: "/etc/grafana/ldap.toml"
76-
# allow_sign_up: False
76+
# allow_sign_up: false
7777
# basic: true
7878

79+
grafana_ldap: {}
80+
# verbose_logging: false
81+
# servers:
82+
# host: 127.0.0.1
83+
# port: 389 # 636 for SSL
84+
# use_ssl: false
85+
# start_tls: false
86+
# ssl_skip_verify: false
87+
# root_ca_cert: /path/to/certificate.crt
88+
# bind_dn: "cn=admin,dc=grafana,dc=org"
89+
# bind_password: grafana
90+
# search_filter: "(cn=%s)" # "(sAMAccountName=%s)" on AD
91+
# search_base_dns:
92+
# - "dc=grafana,dc=org"
93+
# group_search_filter: "(&(objectClass=posixGroup)(memberUid=%s))"
94+
# group_search_base_dns:
95+
# - "ou=groups,dc=grafana,dc=org"
96+
# attributes:
97+
# name: givenName
98+
# surname: sn
99+
# username: sAMAccountName
100+
# member_of: memberOf
101+
# email: mail
102+
# group_mappings:
103+
# - name: Main Org.
104+
# id: 1
105+
# groups:
106+
# - group_dn: "cn=admins,ou=groups,dc=grafana,dc=org"
107+
# org_role: Admin
108+
# - group_dn: "cn=editors,ou=groups,dc=grafana,dc=org"
109+
# org_role: Editor
110+
# - group_dn: "*"
111+
# org_role: Viewer
112+
# - name: Alternative Org
113+
# id: 2
114+
# groups:
115+
# - group_dn: "cn=alternative_admins,ou=groups,dc=grafana,dc=org"
116+
# org_role: Admin
117+
79118
grafana_session: {}
80119
# provider: file
81120
# provider_config: "sessions"

‎molecule/alternative/playbook.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,48 @@
1515
anonymous:
1616
org_name: "Main Organization"
1717
org_role: Viewer
18+
ldap:
19+
config_file: "/etc/grafana/ldap.toml"
20+
allow_sign_up: false
1821
basic: true
22+
grafana_ldap:
23+
verbose_logging: false
24+
servers:
25+
host: 127.0.0.1
26+
port: 389
27+
use_ssl: false
28+
start_tls: false
29+
ssl_skip_verify: false
30+
root_ca_cert: /path/to/certificate.crt
31+
bind_dn: "cn=admin,dc=grafana,dc=org"
32+
bind_password: grafana
33+
search_filter: "(cn=%s)"
34+
search_base_dns:
35+
- "dc=grafana,dc=org"
36+
group_search_filter: "(&(objectClass=posixGroup)(memberUid=%s))"
37+
group_search_base_dns:
38+
- "ou=groups,dc=grafana,dc=org"
39+
attributes:
40+
name: givenName
41+
surname: sn
42+
username: sAMAccountName
43+
member_of: memberOf
44+
email: mail
45+
group_mappings:
46+
- name: Main Organization
47+
id: 1
48+
groups:
49+
- group_dn: "cn=admins,ou=groups,dc=grafana,dc=org"
50+
org_role: Admin
51+
- group_dn: "cn=editors,ou=groups,dc=grafana,dc=org"
52+
org_role: Editor
53+
- group_dn: "*"
54+
org_role: Viewer
55+
- name: Alternative Org
56+
id: 2
57+
groups:
58+
- group_dn: "cn=alternative_admins,ou=groups,dc=grafana,dc=org"
59+
org_role: Admin
1960
grafana_api_keys:
2061
- name: "admin"
2162
role: "Admin"

‎molecule/alternative/tests/test_alternative.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,8 @@ def test_directories(host):
1515
"/var/lib/grafana/plugins/raintank-worldping-app"
1616
]
1717
files = [
18-
"/etc/grafana/grafana.ini"
18+
"/etc/grafana/grafana.ini",
19+
"/etc/grafana/ldap.toml"
1920
]
2021
for directory in dirs:
2122
d = host.file(directory)

‎tasks/configure.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,19 @@
1919
no_log: true
2020
notify: restart grafana
2121

22+
- name: Create grafana LDAP configuration file
23+
template:
24+
src: ldap.toml.j2
25+
dest: "{{ grafana_auth.ldap.config_file | default('/etc/grafana/ldap.toml') }}"
26+
owner: root
27+
group: grafana
28+
mode: 0640
29+
when:
30+
- "'ldap' in grafana_auth"
31+
- "'enabled' not in grafana_auth.ldap or grafana_auth.ldap.enabled"
32+
no_log: true
33+
notify: restart grafana
34+
2235
- name: Create grafana directories
2336
file:
2437
path: "{{ item }}"

‎tasks/preflight.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,3 +53,10 @@
5353
when:
5454
- item.role not in ['Viewer', 'Editor', 'Admin']
5555
with_items: "{{ grafana_api_keys }}"
56+
57+
- name: Fail when grafana_ldap isn't set when grafana_auth.ldap is
58+
fail:
59+
msg: "You need to configure grafana_ldap.servers and grafana_ldap.group_mappings when grafana_auth.ldap is set"
60+
when:
61+
- "'ldap' in grafana_auth"
62+
- grafana_ldap is not defined or ('servers' not in grafana_ldap or 'group_mappings' not in grafana_ldap)

‎templates/ldap.toml.j2‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# {{ ansible_managed }}
2+
# Documentation: http://docs.grafana.org/installation/ldap/
3+
{% if 'verbose_logging' in grafana_ldap %}
4+
verbose_logging = {{ 'true' if grafana_ldap.verbose_logging else 'false' }}
5+
{% endif %}
6+
7+
[[servers]]
8+
{% for k,v in grafana_ldap.servers.items() if k != 'attributes' %}
9+
{% if v in [True, False] %}
10+
{{ k }} = {{ 'true' if v else 'false' }}
11+
{% else %}
12+
{{ k }} = {{ v | to_nice_json }}
13+
{% endif %}
14+
{% endfor %}
15+
16+
[servers.attributes]
17+
{% for k,v in grafana_ldap.servers.attributes.items() %}
18+
{{ k }} = {{ v | to_nice_json }}
19+
{% endfor %}
20+
21+
{% for org in grafana_ldap.group_mappings %}
22+
{% if 'name' in org %}
23+
# {{ org.name }}
24+
{% endif %}
25+
{% for group in org.groups %}
26+
[[servers.group_mappings]]
27+
org_id = {{ org.id }}
28+
{% for k,v in group.items() %}
29+
{{ k }} = "{{ v }}"
30+
{% endfor %}
31+
32+
{% endfor %}
33+
{% endfor %}

0 commit comments

Comments
 (0)