In this step-by-step tutorial, you will learn how to enable Azure AD SAML SSO for open source Grafana via Datawiza. Note that open source Grafana does not support SAML natively, so in the past, you had to buy the enterprise license if you wanted to use SAML . Datawiza eliminates this license requirement by enabling SAML with open source Grafana. Datawiza is a generic identity-aware OIDC/OAuth/SAML proxy with a centralized management console that you can easily use to achieve the same integration with other identity providers like Okta, Auth0, PingIdentity, Google, etc.

Prerequisites

• For creating the Grafana and running Datawiza:
  • Docker (18.03+)
  • Docker Compose

Run Grafana

Grafana provides the official docker images, so we use these to run Grafana:

Introduction to the Datawiza Platform

The Datawiza Platform is a cloud-delivered platform . It includes a data plane and a control plane: Datawiza Access Proxy (DAP) and Datawiza Cloud Management Console (DCMC).

DAP is a lightweight, container-based access proxy deployed close to your application via the sidecar (agent) or gateway mode. It talks to Azure AD SAML on behalf of your applications, so you don’t need to worry about the integration work. DCMC is a cloud-based management console where you can configure and manage the policies of DAPs. Such a SaaS-based design makes the whole platform much easier to use.

Create an App registration in Azure AD

First, we need to create an App registration in the Azure portal. When performing this step, make sure to log in to your account on Azure portal.

You can skip this step if you already have an app integration with the following value: Metadata URL .

Choose Enterprise Applications from the left sidebar and create a new Registration by clicking New registration .

For Attributes & Claims , under Additional Claims, click “ … ” (the three dots ) , then delete and confirm the action next to each row and delete the four default claims.

Click + Add new claim at the top of the page. Configure with the following values:

Go back to Set up Single Sign-On with SAML page. For SAML Signing Certificate , copy the App Federation Metadata Url , which is the Metadata Url needed for DCMC configuration.

Configurations in Datawiza Cloud Management Console

Self-register an account in the Datawiza Management Console. You can easily get started with your Google account, Microsoft account, or GitHub account.

Upon logging into the Datawiza Management Console, click the orange Getting started button.

This runs a step-by-step guide for configuring your application.

Add a New Deployment

The first step of the configuration process is creating a “deployment.” A deployment is a way of organizing applications and identity providers that are associated with the same cluster as  Datawiza Access Proxies. Don’t worry if this seems a bit complicated to understand in the beginning. You will get used to it when you work with it more. For now, just give your deployment a meaningful name and description.

Add a New Application

The second step is to create an application. This is simply collecting the network information of your application.

Here is an explanation of each field.

• Platform: Select WEB here.
• App Name: The name of your application. Put a meaningful name here. We use Grafana demo app .
• Description: A meaningful description for you to understand this application.
• Public Domain: This is how your user will access your application. Normally it’s the URL in the address bar. You can use http://localhost if you are running locally. Be sure to add the port if you have a non-standard one. We use http://localhost:9772 as an example.
• Listen Port: This is the port that the Datawiza Access Proxy listens on. For simplicity, you can use the same port as the one in Public Domain above if you are not deploying the Datawiza Access Proxy behind a load balancer.
• Upstream Servers: This configuration tells Datawiza Access Proxy where the actual Grafana application resides. Enter http://host.docker.internal:3000 .

Note that the upstream server is the address of the application for which you want to enable SSO.

• If you use the DAP in sidecar mode and your application is running on http://localhost:3000 on Mac or Windows, then set the upstream server to http://host.docker.internal:3000 (Docker 18.03+).

If your application is running on Linux, use ip addr show docker0 to get docker host IP (e.g., 172.17.0.1 ) and then set the upstream server to http://172.17.0.1:3000 (see this for more details).

Add a New Identity Provider

The third step is to fill in the identity provider information. Select SAML as the Protocol and Azure AD as the Identity Provider . Input the Metadata Url you saved when creating the app integration in the Azure portal. Upload the cert and key. Certificates in SAML are only used as a convenient way to handle the signing and encryption keys. A pair of self-signed cert and key is OK. Click on Create to proceed.

Start the Access Proxy

The last step of the guide will provide you with the environment configurations. Here you will see the Provision Key and Provision Secret .

Follow the steps (1, 2, and 3) on the page to log in to our docker registry, pull the Access Proxy image, and use the docker-compose.yml file we provided to start the DAP.

Advanced

Although you have added Azure AD authentication to Grafana, there are still several areas you can improve.

As the Grafana walkthrough said, you should not expose ports for Grafana, which should only be connected to by the DAP. An easy way to connect Grafana and DAP without exposing ports is adding Grafana into the DAP docker-compose file:

In the grafana.ini provided by the walkthrough, we simply use X-WEBAUTH-USER as the username. What’s more, Grafana provides the configuration called headers in auth.proxy , which can optionally define more headers to sync other user attributes. We can use it to enrich user info. For example, we want to use user group as a Grafana role and Azure AD email as email: