Merge ~cjohnston/charm-grafana:lp1877796-ldap-integration into charm-grafana:master

[Chris Johnston]

Add support for LDAP authentication.

Add support for LDAP authentication.

This required some refactoring of other pieces that weren't working properly in order to make them work properly as well as the new code working properly.

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

A CI job is currently in progress. A follow up comment will be added when it completes.

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

FAILED: Continuous integration, rev:d5625a8885989faf4ea107e5d0fcc6a6f7587dfb
https://jenkins.canonical.com/bootstack/job/lp-charm-grafana-ci/56/
Executed test runs:
    FAILURE: https://jenkins.canonical.com/bootstack/job/lp-charm-test-unit-withcompiler/157/
    None: https://jenkins.canonical.com/bootstack/job/lp-update-mp/908/

Click here to trigger a rebuild:
https://jenkins.canonical.com/bootstack/job/lp-charm-grafana-ci/56//rebuild

review: Needs Fixing (continuous-integration)

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

A CI job is currently in progress. A follow up comment will be added when it completes.

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

FAILED: Continuous integration, rev:26b5f641f5604389f62f1ee1857bcce47e90ccf2
https://jenkins.canonical.com/bootstack/job/lp-charm-grafana-ci/57/
Executed test runs:
    FAILURE: https://jenkins.canonical.com/bootstack/job/lp-charm-test-unit-withcompiler/158/
    None: https://jenkins.canonical.com/bootstack/job/lp-update-mp/909/

Click here to trigger a rebuild:
https://jenkins.canonical.com/bootstack/job/lp-charm-grafana-ci/57//rebuild

review: Needs Fixing (continuous-integration)

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

A CI job is currently in progress. A follow up comment will be added when it completes.

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

FAILED: Continuous integration, rev:23c2eb59491ebe22fc28edf22f37e9da988b6fc6
https://jenkins.canonical.com/bootstack/job/lp-charm-grafana-ci/58/
Executed test runs:
    FAILURE: https://jenkins.canonical.com/bootstack/job/lp-charm-test-unit-withcompiler/159/
    None: https://jenkins.canonical.com/bootstack/job/lp-update-mp/911/

Click here to trigger a rebuild:
https://jenkins.canonical.com/bootstack/job/lp-charm-grafana-ci/58//rebuild

review: Needs Fixing (continuous-integration)

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

A CI job is currently in progress. A follow up comment will be added when it completes.

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

PASSED: Continuous integration, rev:054d037552176f3ca050be9ad7557133fbca194e
https://jenkins.canonical.com/bootstack/job/lp-charm-grafana-ci/59/
Executed test runs:
    SUCCESS: https://jenkins.canonical.com/bootstack/job/lp-charm-test-unit-withcompiler/160/
    None: https://jenkins.canonical.com/bootstack/job/lp-update-mp/915/

Click here to trigger a rebuild:
https://jenkins.canonical.com/bootstack/job/lp-charm-grafana-ci/59//rebuild

review: Approve (continuous-integration)

[James Troup (elmo)]

See inline comment

review: Needs Fixing

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

A CI job is currently in progress. A follow up comment will be added when it completes.

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

PASSED: Continuous integration, rev:11d7c28c95187eb441346ca8eea31d00b12f78af
https://jenkins.canonical.com/bootstack/job/lp-charm-grafana-ci/60/
Executed test runs:
    SUCCESS: https://jenkins.canonical.com/bootstack/job/lp-charm-test-unit-withcompiler/161/
    None: https://jenkins.canonical.com/bootstack/job/lp-update-mp/918/

Click here to trigger a rebuild:
https://jenkins.canonical.com/bootstack/job/lp-charm-grafana-ci/60//rebuild

review: Approve (continuous-integration)

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

A CI job is currently in progress. A follow up comment will be added when it completes.

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

PASSED: Continuous integration, rev:283eff37925d0a603e720ad6ccf984b2fde7e54d
https://jenkins.canonical.com/bootstack/job/lp-charm-grafana-ci/61/
Executed test runs:
    SUCCESS: https://jenkins.canonical.com/bootstack/job/lp-charm-test-unit-withcompiler/162/
    None: https://jenkins.canonical.com/bootstack/job/lp-update-mp/920/

Click here to trigger a rebuild:
https://jenkins.canonical.com/bootstack/job/lp-charm-grafana-ci/61//rebuild

review: Approve (continuous-integration)

[James Troup (elmo)]

Thanks Chris for working on this - it looks great and is awesome functionality to have. I've reviewed it and I'm happy, my only comment is that you have merge conflicts in the tox.ini - if you fix that, it'll be +1 from me.

review: Needs Fixing

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

A CI job is currently in progress. A follow up comment will be added when it completes.

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change successfully merged at revision 3ec06b8337777d566e34552715c097dab91b4ebc

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

FAILED: Continuous integration, rev:366e4235fa718b38a59e0712209b90668c93ab1f
https://jenkins.canonical.com/bootstack/job/lp-charm-grafana-ci/66/
Executed test runs:
    FAILURE: https://jenkins.canonical.com/bootstack/job/lp-charm-test-functest/489/
    None: https://jenkins.canonical.com/bootstack/job/lp-update-mp/947/

Click here to trigger a rebuild:
https://jenkins.canonical.com/bootstack/job/lp-charm-grafana-ci/66//rebuild

review: Needs Fixing (continuous-integration)

diff --git a/src/README.md b/src/README.md
index 2b3e49c..4e2d009 100644
--- a/src/README.md
+++ b/src/README.md
@@ -129,6 +129,39 @@ If not all URL paths are behind the reverse proxy auth,
 and `anonymous=true` is set, those paths will be accessible (view only) to
 non-authenticated users.
 
+## LDAP auth
+
+Grafana can be deployed to utilize LDAP as an authentication mechanism. To
+enable LDAP authentication, all `ldap_*` config options
+(except `ldap_config_flags`) must be set.
+
+Additional config settings as defined in the upstream
+[LDAP Authentication documentation](https://grafana.com/docs/grafana/latest/auth/ldap/)
+may be set using the `ldap_config_flags` option.
+
+Group mappings for permissions should be defined with the following:
+
+```
+ldap_config_flags: "{
+    group_mapping_admin: 'cn=grafanaadmins,dc=test,dc=com',
+    group_mapping_editor: 'cn=grafanaeditors,dc=test,dc=com',
+    group_mapping_viewer: 'cn=grafanaviewers,dc=test,dc=com',
+}"
+```
+
+Server attributes should be defined as `attribute_<attribute>`. Example:
+
+
+```
+ldap_config_flags: "{
+    "attribute_member_of: memberOf,"
+    "attribute_email: email,"
+    "attribute_name: givenname,"
+    "attribute_surname: sn,"
+    "attribute_username: cn,"
+}"
+```
+
 ## Development
 
 After modifying code, you must assemble the charm:
diff --git a/src/actions/do-upgrade b/src/actions/do-upgrade
index edb0eb9..662fba8 100755
--- a/src/actions/do-upgrade
+++ b/src/actions/do-upgrade
@@ -11,7 +11,10 @@ from charmhelpers.core.hookenv import (
     status_set,
 )
 from charms.layer import snap
-from charms.reactive import remove_state
+from charms.reactive import (
+    remove_state,
+    clear_flag,
+)
 
 
 sys.path.append("lib")
@@ -35,6 +38,7 @@ def snap_upgrade(channel):
         )
         function_set({"result": "Upgraded, channel {}".format(channel)})
         status_set("active", "Ready")
+        clear_flag("snap_channel.change.upgrade")
         remove_state("grafana.change-block")
     elif result == ChangeStatus.UNCHANGED:
         function_fail("Nothing to upgrade")
diff --git a/src/config.yaml b/src/config.yaml
index ed84bc2..3198705 100644
--- a/src/config.yaml
+++ b/src/config.yaml
@@ -85,6 +85,65 @@ options:
     default: False
     type: boolean
     description: Whether to enable default auth.proxy config, defaults to False.
+  ldap_auth:
+    default: False
+    type: boolean
+    description: Whether to enable LDAP authentication, defaults to False.
+  ldap_server:
+    type: string
+    default: ""
+    description: |
+      LDAP server URL for Grafana LDAP identity backend.
+
+      Examples:
+      ldap://10.10.10.10/
+      ldaps://10.10.10.10/
+      ldap://example.com:389/
+      ldap://active-directory-host.com:3268/
+      ldaps://active-directory-host.com:3269/
+
+      An ldap:// URL will result in mandatory StartTLS usage if the
+      charm's ldap_server_ca option has been specified.
+  ldap_server_ca:
+    type: string
+    default: !!null ""
+    description: |
+      This option controls which certificate (or a chain) will be used to connect
+      to the LDAP server over TLS. Certificate contents should either be used
+      directly or included via include-file://
+  ldap_user:
+    type: string
+    default: ""
+    description: |
+      Username (Distinguished Name) used to bind to LDAP identity server.
+      .
+      Example: cn=admin,dc=test,dc=com
+  ldap_password:
+    type: string
+    default: ""
+    description: Password of the LDAP identity server.
+  ldap_base_dn:
+    type: string
+    default: ""
+    description: Comma separated list of base dns to be used by Grafana.
+  ldap_config_flags:
+    type: string
+    default: ""
+    description: |
+      Additional LDAP configuration options.
+      For simple configurations use a comma separated string of key=value pairs.
+      "ssl_skip_verify=false, group_search_filter_user_attribute='uid'"
+      For more complex configurations use a json like string with double quotes
+      and braces around all the options and single quotes around complex values.
+      "{ssl_skip_verify: false,
+        group_mapping_admin: 'cn=grafanaadmins,dc=test,dc=com',
+        group_mapping_editor: 'cn=grafanaeditors,dc=test,dc=com',
+        group_mapping_viewer: 'cn=grafanaviewers,dc=test,dc=com'}"
+
+      See the README for more details.
+
+      Note: The explicitly defined ldap_* charm config options are required
+      and cannot be set via `ldap_config_flags`.
   datasources:
     default: ""
     type: string
diff --git a/src/lib/charms/layer/grafana.py b/src/lib/charms/layer/grafana.py
index 10135be..9c0fb16 100644
--- a/src/lib/charms/layer/grafana.py
+++ b/src/lib/charms/layer/grafana.py
@@ -3,11 +3,14 @@
 import base64
 import enum
 import json
+import os
 import re
 import subprocess
 import tempfile
+from urllib.parse import urlparse
 
-from charmhelpers.core import unitdata
+from charmhelpers.contrib.openstack.utils import config_flags_parser
+from charmhelpers.core import host, unitdata
 from charmhelpers.core.hookenv import (
     cached,
     config,
@@ -15,9 +18,15 @@ from charmhelpers.core.hookenv import (
     model_name,
     status_set,
 )
+from charmhelpers.core.templating import render
+
 
 from charms.layer import snap
-from charms.reactive.flags import is_flag_set
+from charms.reactive.flags import (
+    clear_flag,
+    is_flag_set,
+    set_flag,
+)
 
 import requests
 
@@ -28,6 +37,7 @@ import requests
 # https://git.launchpad.net/ubuntu/+source/python-certifi/tree/debian/patches/0001-Use-Debian-provided-etc-ssl-certs-ca-certificates.cr.patch
 SYSTEM_CA_BUNDLE = "/etc/ssl/certs/ca-certificates.crt"
 CA_CERT_PATH = "/var/snap/grafana/common/ssl/ca-certificates.crt"
+LDAP_TOML_TMPL = "ldap.toml.j2"
 
 
 class ChangeStatus(enum.Enum):
@@ -311,13 +321,13 @@ def check_snap_channel(snap_name, channel):
             'The "latest" track is not supported; revert the channel config '
             "change to unblock"
         )
-        status_set("blocked", msg)
         log(msg)
+        set_flag("snap_channel.change.latest")
         return ChangeStatus.LATEST
     if new_ver == -1:
         msg = "Invalid snap channel: {}".format(channel)
-        status_set("blocked", msg)
         log(msg)
+        set_flag("snap_channel.change.invald")
         return ChangeStatus.INVALID
     if installed_ver == new_ver and not is_refresh_available:
         status_set("active", "Ready")
@@ -331,17 +341,15 @@ def check_snap_channel(snap_name, channel):
         status_set("active", "Refresh complete")
         return ChangeStatus.UNCHANGED
     if installed_ver < new_ver:
-        msg = (
-            "PACKAGE UPGRADE REQUIRES MANUAL INTERVENTION: see {} for more info"
-        ).format(VERSION_CHANGE_URL)
-        status_set("blocked", msg)
+        msg = "PACKAGE UPGRADE REQUIRES MANUAL INTERVENTION"
         log(msg)
+        set_flag("snap_channel.change.upgrade")
         return ChangeStatus.UPGRADE
     msg = (
         "PACKAGE DOWNGRADES ARE NOT SUPPORTED BY THIS CHARM - to clear "
         "this message, set config 'snap_channel' to '{}/stable'"
     ).format(installed_ver)
-    status_set("blocked", msg)
+    set_flag("snap_channel.change.downgrade")
     log(msg)
     return ChangeStatus.DOWNGRADE
 
@@ -379,3 +387,103 @@ def get_instance_name():
         return config("instance_name")
     else:
         return "127.0.0.1"
+
+
+def get_ldap_configs_changed(config):
+    """Check to see if any LDAP config flags have changed. If yes, configure LDAP."""
+    ldap_cfgs = [k for k in config if k.startswith("ldap_")]
+    for ldap_cfg in ldap_cfgs:
+        if config.changed(ldap_cfg):
+            clear_flag("grafana.ldap.configured")
+
+
+def check_ldap_config_valid(config):
+    """Determine whether sufficient configuration has been provided."""
+    required_config = {
+        "ldap_server": config["ldap_server"],
+        "ldap_user": config["ldap_user"],
+        "ldap_password": config["ldap_password"],
+        "ldap_base_dn": config["ldap_base_dn"],
+    }
+    return all(required_config.values())
+
+
+def render_ldap_ca(ldap_server_ca, ldap_ca_path):
+    """Render crt file for LDAP server."""
+    host.write_file(
+        ldap_ca_path,
+        ldap_server_ca,
+        owner="root",
+        group="root",
+        perms=0o644,
+    )
+
+
+def render_ldap_config(config, ldap_toml_path, ldap_ca_path=None):
+    """Validate and render the ldap config file."""
+    clear_flag("ldap.config.incomplete")
+    log("Setting up LDAP auth...")
+    parsed_url = urlparse(config["ldap_server"])
+    ldap_options, group_mappings, server_attributes = parse_ldap_config_flags(
+        config["ldap_config_flags"]
+    )
+    settings = {
+        "config": config,
+        "host": parsed_url.hostname,
+        "port": parsed_url.port if parsed_url.port else "389",
+        "ldap_options": ldap_options,
+        "group_mappings": group_mappings,
+        "server_attributes": server_attributes,
+    }
+    if parsed_url.scheme == "ldaps" or ldap_ca_path:
+        settings["ssl"] = "true"
+    if ldap_ca_path:
+        render_ldap_ca(config["ldap_server_ca"], ldap_ca_path)
+        settings["ldap_ca_path"] = ldap_ca_path
+    render(
+        source=LDAP_TOML_TMPL,
+        target=ldap_toml_path,
+        context=settings,
+        owner="grafana",
+        group="grafana",
+        perms=0o600,
+    )
+    status_set("active", "Completed configuring LDAP authentication")
+    clear_flag("grafana.configured")
+
+
+def parse_ldap_config_flags(ldap_config_flags):
+    """Parse through the ldap_config_flags."""
+    ldap_options = {}
+    group_mappings = {}
+    server_attributes = {}
+    if ldap_config_flags:
+        parsed_config_flags = config_flags_parser(ldap_config_flags)
+        for k, v in parsed_config_flags.items():
+            if k.startswith("group_mappings_"):
+                group_mappings.update({k: v})
+            elif k.startswith("attribute_"):
+                new_k = k.replace("attribute_", "")
+                server_attributes.update({new_k: v})
+            else:
+                ldap_options.update({k: v})
+    return ldap_options, group_mappings, server_attributes
+
+
+def remove_ldap_authentication(ldap_toml_path, ldap_ca_path):
+    """Remove LDAP config files if they exist and restart Grafana if needed."""
+    restart_needed = False
+    try:
+        os.remove(ldap_toml_path)
+        clear_flag("grafana.configured")
+        restart_needed = True
+    except FileNotFoundError:
+        pass
+    try:
+        os.remove(ldap_ca_path)
+        # Is the clear flag actually needed?
+        clear_flag("grafana.configured")
+    except FileNotFoundError:
+        pass
+
+    return restart_needed
diff --git a/src/reactive/grafana.py b/src/reactive/grafana.py
index 9672653..dd70008 100644
--- a/src/reactive/grafana.py
+++ b/src/reactive/grafana.py
@@ -96,6 +96,7 @@ from charms.layer import snap, tls_client
 from charms.layer.grafana import (
     CA_CERT_PATH,
     ChangeStatus,
+    check_ldap_config_valid,
     check_snap_channel,
     config_defined_ssl_ca,
     config_defined_ssl_cert,
@@ -106,12 +107,18 @@ from charms.layer.grafana import (
     get_deb_package_version,
     get_installed_package_version,
     get_instance_name,
+    get_ldap_configs_changed,
     get_protocol,
     import_dashboard,
+    parse_snap_major_version,
+    remove_ldap_authentication,
+    render_ldap_config,
 )
 from charms.reactive import (
+    clear_flag,
     hook,
     remove_state,
+    set_flag,
     set_state,
     when,
     when_any,
@@ -155,6 +162,14 @@ GRAFANA_INI = {
     "snap": "{}/conf/grafana.ini".format(SNAP_DATA),
     "apt": "/etc/grafana/grafana.ini",
 }
+LDAP_TOML_PATH = {
+    "snap": "{}/conf/ldap.toml".format(SNAP_DATA),
+    "apt": "/etc/grafana/ldap.toml",
+}
+LDAP_CA_PATH = {
+    "snap": "{}/ldap_ca.crt".format(SNAP_DATA),
+    "apt": "/usr/share/ca-certificates/ldap_ca.crt",
+}
 GRAFANA_INI_TMPL = "grafana.ini.j2"
 GRAFANA_DEPS = ["libfontconfig1"]
 DASHBOARDS_BACKUP_CRON = "/etc/cron.d/juju-dashboards-backup"
@@ -198,11 +213,9 @@ def install_packages():
     if not kv.get("install_method", False):
         kv.set("install_method", source)
     elif kv.get("install_method") != source:
-        hookenv.status_set(
-            "blocked",
-            "Install method changes are not supported, "
-            "revert install_method option to previous value",
-        )
+        set_flag("grafana.change-block")
+        set_flag("install_method.changed")
+        set_final_status()
         return
 
     if source == "apt":
@@ -259,7 +272,10 @@ def install_packages():
         set_state("grafana.installed")
         hookenv.status_set("blocked", "Missing relations: grafana-source")
     else:
-        hookenv.status_set("blocked", "Unsupported install_method")
+        set_flag("install_method.unsupported")
+        return
+    clear_flag("install_method.changed")
+    clear_flag("install_method.unsupported")
 
 
 def data_path():
@@ -326,12 +342,19 @@ def upgrade_charm():
 def config_changed():
     """Run config-changed hook."""
     config = hookenv.config()
+    if config.changed("install_method"):
+        clear_flag("grafana.installed")
+        clear_flag("grafana.change-block")
     if (
         config.changed("snap_channel")
         and config["snap_channel"]
         and not config.changed("install_method")
         and config["install_method"] == "snap"
     ):
+        clear_flag("snap_channel.change.latest")
+        clear_flag("snap_channel.change.invalid")
+        clear_flag("snap_channel.change.downgrade")
+        clear_flag("snap_channel.change.upgrade")
         # NOTE(aluria): install_method change (apt -> snap, and viceversa)
         # is not supported. However, snap channel change support was missing
         if snap.is_installed(SNAP_NAME):
@@ -367,6 +390,7 @@ def config_changed():
     if config.changed("site_name"):
         application_dashboard_relation_changed()
     remove_state("grafana.nagios-setup.completed")
+    get_ldap_configs_changed(config)
 
 
 def check_ports(new_port):
@@ -511,6 +535,8 @@ def setup_grafana():
         "cert_file": CERT_PATH[config["install_method"]],
         "cert_key": CERT_KEY_PATH[config["install_method"]],
     }
+    if is_flag_set("grafana.ldap.configured"):
+        settings["ldap_toml_path"] = LDAP_TOML_PATH[source]
 
     smtp_auth = config.get("smtp_auth", False)
     if smtp_auth and len(smtp_auth.split(":")) == 2:
@@ -608,13 +634,15 @@ def restart_grafana():
 
     svcname = SVCNAME[source]
     grafana_ini = GRAFANA_INI[source]
+    ldap_toml = LDAP_TOML_PATH[source]
+    configs_changed = any_file_changed([grafana_ini, ldap_toml])
 
     if not host.service_running(svcname):
         msg = "Starting {}".format(svcname)
         hookenv.status_set("maintenance", msg)
         hookenv.log(msg)
         host.service_start(svcname)
-    elif any_file_changed([grafana_ini]) or is_state("config.changed.install_plugins"):
+    elif configs_changed or is_state("config.changed.install_plugins"):
         msg = "Restarting {}".format(svcname)
         hookenv.log(msg)
         hookenv.status_set("maintenance", msg)
@@ -1409,6 +1437,38 @@ def import_dashboards(dashboards):
     kv.set("dash_digests", dashboard_digests)
 
 
+@when("grafana.started")
+@when_not("grafana.ldap.configured")
+@when_not("grafana.change-block")
+def configure_ldap_authentication():
+    """Configure LDAP authentication."""
+    config = hookenv.config()
+    source = get_install_source()
+    if not source:
+        return
+    ldap_toml_path = LDAP_TOML_PATH[source]
+    ldap_ca_path = LDAP_CA_PATH[source]
+    if config.get("ldap_auth"):
+        if not check_ldap_config_valid(config):
+            hookenv.log("Missing required config options for configuring LDAP.")
+            set_flag("ldap.config.incomplete")
+            restart_needed = remove_ldap_authentication(ldap_toml_path, ldap_ca_path)
+            if restart_needed:
+                setup_grafana()
+                restart_grafana()
+            set_final_status()
+        else:
+            if config.get("ldap_server_ca") and config.changed("ldap_server_ca"):
+                render_ldap_config(config, ldap_toml_path, ldap_ca_path)
+            else:
+                render_ldap_config(config, ldap_toml_path)
+            set_flag("grafana.ldap.configured")
+    else:
+        if is_flag_set("ldap.config.incomplete"):
+            clear_flag("ldap.config.incomplete")
+        remove_ldap_authentication(ldap_toml_path, ldap_ca_path)
+
+
 @when("certificates.available")
 @when_not("grafana.certificates.configured")
 @when_not("grafana.certificates.requested")
@@ -1438,6 +1498,7 @@ def tls_request_certificate(tls):
 
 @when("tls_client.certs.changed")
 @when("grafana.certificates.requested")
+@when_not("grafana.change-block")
 def tls_certificate_changed():
     """Request to reconfigure grafana after the certificates were written."""
     _ensure_certs_permissions()
@@ -1533,3 +1594,54 @@ def _uninstall_cert_key():
         hookenv.log("Certificate key {0} removed.".format(key_path), level=hookenv.INFO)
     except FileNotFoundError:
         pass
+
+
+@when("grafana.configured")
+def set_final_status():
+    """Set the final status of the charm as we leave hook execution."""
+    config = hookenv.config()
+
+    if is_flag_set("install_method.changed"):
+        hookenv.status_set(
+            "blocked",
+            "Install method changes are not supported, "
+            "revert install_method option to previous value",
+        )
+        return
+
+    if is_flag_set("install_method.unsupported"):
+        hookenv.status_set("blocked", "Unsupported install_method")
+        return
+
+    if is_flag_set("ldap.config.incomplete"):
+        hookenv.status_set("blocked", "LDAP configuration incomplete")
+        return
+
+    if is_flag_set("snap_channel.change.latest"):
+        msg = (
+            'The "latest" track is not supported; revert the channel config '
+            "change to unblock"
+        )
+        hookenv.status_set("blocked", msg)
+        return
+
+    if is_flag_set("snap_channel.change.invalid"):
+        msg = "Invalid snap channel: {}".format(config["snap_channel"])
+        hookenv.status_set("blocked", msg)
+        return
+
+    if is_flag_set("snap_channel.change.upgrade"):
+        msg = "PACKAGE UPGRADE REQUIRES MANUAL INTERVENTION"
+        hookenv.status_set("blocked", msg)
+        return
+
+    if is_flag_set("snap_channel.change.downgrade"):
+        installed_ver = parse_snap_major_version(snap.get_installed_channel(SNAP_NAME))
+        msg = (
+            "PACKAGE DOWNGRADES ARE NOT SUPPORTED BY THIS CHARM - to clear "
+            "this message, set config 'snap_channel' to '{}/stable'"
+        ).format(installed_ver)
+        hookenv.status_set("blocked", msg)
+        return
+
+    hookenv.status_set("active", "Ready")
diff --git a/src/templates/grafana.ini.j2 b/src/templates/grafana.ini.j2
index aed60b2..4d13235 100644
--- a/src/templates/grafana.ini.j2
+++ b/src/templates/grafana.ini.j2
@@ -200,8 +200,13 @@ auto_sign_up = true
 
 #################################### Auth LDAP ##########################
 [auth.ldap]
+{% if config['ldap_auth'] and ldap_toml_path -%}
+enabled = true
+config_file = {{ ldap_toml_path }}
+{% else -%}
 ;enabled = false
 ;config_file = /etc/grafana/ldap.toml
+{% endif %}
 
 #################################### SMTP / Emailing ##########################
 [smtp]
diff --git a/src/templates/ldap.toml.j2 b/src/templates/ldap.toml.j2
new file mode 100644
index 0000000..bbf0d27
--- /dev/null
+++ b/src/templates/ldap.toml.j2
@@ -0,0 +1,58 @@
+[[servers]]
+host = "{{ host }}"
+port = {{ port }} 
+bind_dn = "{{ config.ldap_user }}"
+bind_password = "{{ config.ldap_password }}"
+{% if ssl or config.ldap_server_ca -%}
+use_ssl = true
+{% if config.ldap_server_ca -%}
+root_ca_cert = {{ ldap_ca_path }}
+{% endif -%}
+{% else -%}
+use_ssl = false
+{% endif -%}
+search_base_dns = ["{{ config.ldap_base_dn }}"]
+
+{% if 'search_filter' not in ldap_options -%}
+search_filter = "(cn=%s)"
+{% endif -%}
+{% if ldap_options -%}
+{% for key, value in ldap_options.items() -%}
+{% if key == 'group_search_base_dns' -%}
+group_search_base_dns = ["{{ value }}"]
+{% else -%}
+{{ key }} = "{{ value }}"
+{% endif -%}
+{% endfor -%}
+{% endif -%}
+
+{% if server_attributes -%}
+[servers.attributes]
+{% for key, value in server_attributes.items() -%}
+{{ key }} = "{{ value }}"
+{% endfor -%}
+{% endif -%}
+
+{% if group_mappings -%}
+{% for key, value in group_mappings.items() -%}
+{% if key == "group_mappings_admin" -%}
+
+[[servers.group_mappings]]
+group_dn = "{{ value }}"
+org_role = "Admin"
+grafana_admin = true
+{% endif -%}
+
+{% if key == "group_mappings_editor" -%}
+[[servers.group_mappings]]
+group_dn = "{{ value }}"
+org_role = "Editor"
+{% endif -%}
+
+{% if key == "group_mappings_viewer" -%}
+[[servers.group_mappings]]
+group_dn = "{{ value }}"
+org_role = "Viewer"
+{% endif -%}
+{% endfor -%}
+{% endif -%}
diff --git a/src/tests/functional/tests/bundles/base.yaml b/src/tests/functional/tests/bundles/base.yaml
index 6b4b218..47354fa 100644
--- a/src/tests/functional/tests/bundles/base.yaml
+++ b/src/tests/functional/tests/bundles/base.yaml
@@ -53,7 +53,10 @@ applications:
     charm: cs:~llama-charmers-next/prometheus-ceph-exporter
     num_units: 1
   prometheus-libvirt-exporter:
-    charm: cs:~llama-charmers-next/prometheus-libvirt-exporter
+    charm: cs:~llama-charmers/prometheus-libvirt-exporter
+  ldap-server:
+    charm: cs:~openstack-charmers/ldap-test-fixture
+    num_units: 1
 
 relations:
 - - keystone:shared-db
diff --git a/src/tests/functional/tests/bundles/overlays/focal-self-signed-cert.yaml.j2 b/src/tests/functional/tests/bundles/overlays/focal-self-signed-cert.yaml.j2
index c31d2db..cbe4f51 100644
--- a/src/tests/functional/tests/bundles/overlays/focal-self-signed-cert.yaml.j2
+++ b/src/tests/functional/tests/bundles/overlays/focal-self-signed-cert.yaml.j2
@@ -23,3 +23,5 @@ applications:
     series: bionic
   nagios:
     series: bionic
+  ldap-server:
+    series: bionic
diff --git a/src/tests/functional/tests/bundles/overlays/focal-snap-self-signed-cert.yaml.j2 b/src/tests/functional/tests/bundles/overlays/focal-snap-self-signed-cert.yaml.j2
index 623d230..fafffe0 100644
--- a/src/tests/functional/tests/bundles/overlays/focal-snap-self-signed-cert.yaml.j2
+++ b/src/tests/functional/tests/bundles/overlays/focal-snap-self-signed-cert.yaml.j2
@@ -25,3 +25,5 @@ applications:
     series: bionic
   nagios:
     series: bionic
+  ldap-server:
+    series: bionic
diff --git a/src/tests/functional/tests/bundles/overlays/focal-snap-tls.yaml.j2 b/src/tests/functional/tests/bundles/overlays/focal-snap-tls.yaml.j2
index 259f3c5..e0b8218 100644
--- a/src/tests/functional/tests/bundles/overlays/focal-snap-tls.yaml.j2
+++ b/src/tests/functional/tests/bundles/overlays/focal-snap-tls.yaml.j2
@@ -25,6 +25,8 @@ applications:
     series: bionic
   nagios:
     series: bionic
+  ldap-server:
+    series: bionic
   easyrsa:
     charm: cs:~containers/easyrsa
     num_units: 1
diff --git a/src/tests/functional/tests/bundles/overlays/focal-snap.yaml.j2 b/src/tests/functional/tests/bundles/overlays/focal-snap.yaml.j2
index 9200330..fafffe0 100644
--- a/src/tests/functional/tests/bundles/overlays/focal-snap.yaml.j2
+++ b/src/tests/functional/tests/bundles/overlays/focal-snap.yaml.j2
@@ -24,4 +24,6 @@ applications:
   prometheus-libvirt-exporter:
     series: bionic
   nagios:
-    series: bionic
\ No newline at end of file
+    series: bionic
+  ldap-server:
+    series: bionic
diff --git a/src/tests/functional/tests/bundles/overlays/focal-tls.yaml.j2 b/src/tests/functional/tests/bundles/overlays/focal-tls.yaml.j2
index b6283dc..46465c3 100644
--- a/src/tests/functional/tests/bundles/overlays/focal-tls.yaml.j2
+++ b/src/tests/functional/tests/bundles/overlays/focal-tls.yaml.j2
@@ -24,6 +24,8 @@ applications:
     series: bionic
   nagios:
     series: bionic
+  ldap-server:
+    series: bionic
   easyrsa:
     charm: cs:~containers/easyrsa
     num_units: 1
diff --git a/src/tests/functional/tests/bundles/overlays/focal.yaml.j2 b/src/tests/functional/tests/bundles/overlays/focal.yaml.j2
index c2a7e8b..139cc4d 100644
--- a/src/tests/functional/tests/bundles/overlays/focal.yaml.j2
+++ b/src/tests/functional/tests/bundles/overlays/focal.yaml.j2
@@ -23,4 +23,6 @@ applications:
   prometheus-libvirt-exporter:
     series: bionic
   nagios:
-    series: bionic
\ No newline at end of file
+    series: bionic
+  ldap-server:
+    series: bionic
diff --git a/src/tests/functional/tests/bundles/overlays/xenial-tls.yaml.j2 b/src/tests/functional/tests/bundles/overlays/xenial-tls.yaml.j2
index 86f7ebf..1c1e894 100644
--- a/src/tests/functional/tests/bundles/overlays/xenial-tls.yaml.j2
+++ b/src/tests/functional/tests/bundles/overlays/xenial-tls.yaml.j2
@@ -8,5 +8,7 @@ applications:
     series: bionic
     charm: cs:~containers/easyrsa
     num_units: 1
+  ldap-server:
+    series: bionic
 relations:
   - [ grafana:certificates, easyrsa ]
diff --git a/src/tests/functional/tests/bundles/overlays/xenial.yaml.j2 b/src/tests/functional/tests/bundles/overlays/xenial.yaml.j2
index 648f471..b3dd868 100644
--- a/src/tests/functional/tests/bundles/overlays/xenial.yaml.j2
+++ b/src/tests/functional/tests/bundles/overlays/xenial.yaml.j2
@@ -3,3 +3,5 @@ applications:
   grafana:
     options:
       install_method: apt
+  ldap-server:
+    series: bionic
diff --git a/src/tests/functional/tests/test_grafana.py b/src/tests/functional/tests/test_grafana.py
index eb49a09..30dbe9e 100644
--- a/src/tests/functional/tests/test_grafana.py
+++ b/src/tests/functional/tests/test_grafana.py
@@ -1,4 +1,4 @@
-"""Encapsulate prometheus-openstack-exporter testing."""
+"""Encapsulate Grafana testing."""
 import base64
 import json
 import logging
@@ -16,10 +16,21 @@ TEST_TIMEOUT = 600
 DEFAULT_API_PORT = "3000"
 DEFAULT_API_URL = "/"
 DEFAULT_BACKUP_DIRECTORY = "/srv/backups"
+SNAP_NAME = "grafana"
+SNAP_DATA = "/var/snap/{}/current".format(SNAP_NAME)
+SNAP_COMMON_DATA = "/var/snap/{}/common/data".format(SNAP_NAME)
+LDAP_TOML = {
+    "snap": "{}/conf/ldap.toml".format(SNAP_DATA),
+    "apt": "/etc/grafana/ldap.toml",
+}
+DATA_DIR = {
+    "snap": SNAP_COMMON_DATA,
+    "apt": "/var/lib/grafana",
+}
 
 
 class BaseGrafanaTest(unittest.TestCase):
-    """Base for Prometheus-openstack-exporter charm tests.
+    """Base for Grafana charm tests.
 
     - Get the CA from easyrsa (when available) and write it on disk.
     """
@@ -32,6 +43,9 @@ class BaseGrafanaTest(unittest.TestCase):
         super(BaseGrafanaTest, cls).setUpClass()
         cls.model_name = model.get_juju_model()
         cls.application_name = "grafana"
+        cls.install_method = model.get_application_config(cls.application_name)[
+            "install_method"
+        ].get("value")
         cls.lead_unit_name = model.get_lead_unit_name(
             cls.application_name, model_name=cls.model_name
         )
@@ -107,15 +121,8 @@ class BaseGrafanaTest(unittest.TestCase):
         timeout = time.time() + TEST_TIMEOUT
         dashboards = []
         while True:
-            req = requests.get(
-                "{protocol}://{host}:{port}"
-                "/api/search?dashboardIds".format(
-                    protocol=self.get_protocol(),
-                    host=self.grafana_ip,
-                    port=DEFAULT_API_PORT,
-                ),
-                auth=("admin", self.admin_password),
-                verify=self.ca_path,
+            req = self.query_grafana_website(
+                "admin", self.admin_password, "api/search?dashboardIds"
             )
             self.assertEqual(req.status_code, 200)
             dashboards = json.loads(req.text)
@@ -124,6 +131,24 @@ class BaseGrafanaTest(unittest.TestCase):
             time.sleep(30)
         return dashboards
 
+    def query_grafana_website(self, user, password, url_path=None):
+        """Load a url."""
+        if url_path is None:
+            url = "{protocol}://{host}:{port}/".format(
+                protocol=self.get_protocol(),
+                host=self.grafana_ip,
+                port=DEFAULT_API_PORT,
+            )
+        else:
+            url = "{protocol}://{host}:{port}/{path}".format(
+                protocol=self.get_protocol(),
+                host=self.grafana_ip,
+                port=DEFAULT_API_PORT,
+                path=url_path,
+            )
+        req = requests.get(url, auth=(user, password), verify=self.ca_path)
+        return req
+
     def remote_sed(self, unit, file, expr):
         """Run sed on remote unit."""
         cmd = ["sed", "-i", "-e", expr, file]
@@ -224,6 +249,32 @@ class CharmOperationTest(BaseGrafanaTest):
         content = result.get("Stdout")
         self.assertIn(expected_nrpe_check, content)
 
+    def test_03_change_install_method(self):
+        """Test changing install_method results in a blocked state."""
+        revert = ""
+        if self.install_method == "apt":
+            model.set_application_config(
+                self.application_name,
+                {"install_method": "snap"},
+            )
+            revert = "apt"
+        else:
+            model.set_application_config(
+                self.application_name,
+                {"install_method": "apt"},
+            )
+            revert = "snap"
+        model.block_until_unit_wl_status(self.lead_unit_name, "blocked")
+        model.block_until_all_units_idle()
+        status_message = self.get_unit_status(self.lead_unit_name)
+        self.assertIn("Install method changes are not support", status_message)
+        model.set_application_config(
+            self.application_name,
+            {"install_method": revert},
+        )
+        model.block_until_unit_wl_status(self.lead_unit_name, "active")
+        model.block_until_all_units_idle()
+
     def test_10_grafana_imported_dashboards(self):
         """Check that Grafana dashboards expected are there."""
         dashboards = self.get_and_check_dashboards(lambda dashes: len(dashes) >= 4)
@@ -284,15 +335,7 @@ class CharmOperationTest(BaseGrafanaTest):
         )
         self.assertEqual(action.data["results"]["Code"], "0")
         time.sleep(30)  # Dirty hack to overcome race condition
-        req = requests.get(
-            "{protocol}://{host}:{port}/api/org/".format(
-                protocol=self.get_protocol(),
-                host=self.grafana_ip,
-                port=DEFAULT_API_PORT,
-            ),
-            auth=("foouser", "sikkrit"),
-            verify=self.ca_path,
-        )
+        req = self.query_grafana_website("foouser", "sikkrit", "api/org/")
         self.assertEqual(req.status_code, 200)
         self.assertIn("name", req.json())
 
@@ -337,6 +380,9 @@ class CharmOperationTest(BaseGrafanaTest):
         )
         self.assertIn(port, crontab["Stdout"])
         self.verify_iterative_backups()
+        # Reset the port so that later tests work without issue
+        model.reset_application_config(self.application_name, ["port"])
+        model.block_until_all_units_idle()
 
     def test_15_grafana_datasource_updates(self):
         """Change the port on the associated datasource.
@@ -347,10 +393,159 @@ class CharmOperationTest(BaseGrafanaTest):
         As per LP #1893320
         """
         datasource_application = "prometheus"
-        port_config = {"web-listen-port": "1234"}
+        new_port = "1234"
+        port_config = {"web-listen-port": new_port}
         model.set_application_config(datasource_application, port_config)
         model.block_until_all_units_idle()
 
+        # It has been seen that this test may complete due to a slight gap in
+        # time between prometheus going idle and grafana going executing for
+        # this change. Therefore we should verify that the port is now
+        # configured as expected prior to moving on.
+        db_path = "{}/grafana.db".format(DATA_DIR[self.install_method])
+        py = """python3 -c 'import sqlite3; output = """
+        conn = """sqlite3.connect("{}", timeout=30)""".format(db_path)
+        query = "SELECT * FROM data_source;"
+        final = ".fetchall(); print(output)"
+        cmd = """{} {}.cursor().execute("{}"){}'""".format(py, conn, query, final)
+        # count = 0
+        timeout = time.time() + TEST_TIMEOUT
+        while time.time() < timeout:
+            result = model.run_on_unit(self.lead_unit_name, cmd)
+            if new_port in result["Stdout"]:
+                return
+            logging.info("Port not updated yet.. Retrying in 30s.")
+            time.sleep(30)
+        # The port did not change in the allowed time, fail the test
+        self.fail("The port did not change as expected. \n" "Result: {}".format(result))
+
+    def test_20_ldap_not_configured(self):
+        """Ensure that LDAP authentication is not configured when not set."""
+        config_file = LDAP_TOML[self.install_method]
+        expected_output = "cat: {}: No such file or directory".format(config_file)
+        ldap_cfg = model.run_on_unit(
+            self.lead_unit_name,
+            "cat %s" % config_file,
+        )
+        self.assertIn(expected_output, ldap_cfg["Stderr"])
+
+    def test_21_incomplete_ldap_config_raises_blocked(self):
+        """Incomplete LDAP configuration results in a blocked state."""
+        model.set_application_config(
+            self.application_name,
+            {
+                "ldap_auth": "true",
+                "ldap_password": "crapper",
+            },
+        )
+        model.block_until_unit_wl_status(self.lead_unit_name, "blocked")
+        model.block_until_all_units_idle()
+        status_message = self.get_unit_status(self.lead_unit_name)
+        self.assertIn("LDAP configuration incomplete", status_message)
+
+    def test_22_configure_ldap_authentication(self):
+        """Configure LDAP authentication and validate that a user can login."""
+        expected_group_mappings = "[[servers.group_mappings]]"
+        config_file = LDAP_TOML[self.install_method]
+        ldap_server_ip = model.get_app_ips("ldap-server")[0]
+        ldap_config_flags = (
+            "{"
+            "attribute_member_of: memberOf,"
+            "attribute_email: email,"
+            "attribute_name: givenname,"
+            "attribute_surname: sn,"
+            "attribute_username: cn,"
+            "}"
+        )
+        model.set_application_config(
+            self.application_name,
+            {
+                "ldap_auth": "true",
+                "ldap_password": "crapper",
+                "ldap_user": "cn=admin,dc=test,dc=com",
+                "ldap_base_dn": "dc=test,dc=com",
+                "ldap_server": "ldap://{}".format(ldap_server_ip),
+                "ldap_config_flags": ldap_config_flags,
+            },
+        )
+        model.block_until_unit_wl_status(self.lead_unit_name, "active")
+        model.block_until_all_units_idle()
+        ldap_cfg = model.file_contents(self.lead_unit_name, config_file)
+        self.assertIn("port = 389", ldap_cfg)
+        self.assertIn('host = "{}"'.format(ldap_server_ip), ldap_cfg)
+        # Check that server.group_mappings is not in the file.
+        self.assertNotIn(expected_group_mappings, ldap_cfg)
+        jane_req = self.query_grafana_website("janedoe", "crapper", "api/org/")
+        self.assertEqual(jane_req.status_code, 200)
+        self.assertIn("name", jane_req.json())
+
+    def test_23_configure_ldap_group_mappings(self):
+        """Configure ldap group mappings and validate the correct user can login."""
+        config_file = LDAP_TOML[self.install_method]
+        ldap_server_ip = model.get_app_ips("ldap-server")[0]
+        model.set_application_config(self.application_name, {})
+        expected_group_mappings_admin = (
+            "[[servers.group_mappings]]\n"
+            'group_dn = "cn=admin,ou=groups,dc=test,dc=com"\n'
+            'org_role = "Admin"\n'
+            "grafana_admin = true\n"
+        )
+        expected_group_mappings_viewer = (
+            "[[servers.group_mappings]]\n"
+            'group_dn = "cn=openstack,ou=groups,dc=test,dc=com"\n'
+            'org_role = "Viewer"\n'
+        )
+        ldap_config_flags = (
+            "{"
+            "group_mappings_admin: 'cn=admin,ou=groups,dc=test,dc=com',"
+            "group_mappings_viewer: 'cn=openstack,ou=groups,dc=test,dc=com',"
+            "group_search_base_dns: 'ou=groups,dc=test,dc=com',"
+            "group_search_filter_user_attribute: 'uid',"
+            "group_search_filter: '(&(objectClass=posixGroup)(memberUid=%s))',"
+            "attribute_member_of: memberOf,"
+            "attribute_email: email,"
+            "attribute_name: givenname,"
+            "attribute_surname: sn,"
+            "attribute_username: cn,"
+            "}"
+        )
+        model.set_application_config(
+            self.application_name,
+            {
+                "ldap_auth": "true",
+                "ldap_password": "crapper",
+                "ldap_user": "cn=admin,dc=test,dc=com",
+                "ldap_base_dn": "dc=test,dc=com",
+                "ldap_server": "ldap://{}".format(ldap_server_ip),
+                "ldap_config_flags": ldap_config_flags,
+            },
+        )
+        model.block_until_unit_wl_status(self.lead_unit_name, "active")
+        model.block_until_all_units_idle()
+        ldap_cfg = model.file_contents(self.lead_unit_name, config_file)
+        self.assertIn(expected_group_mappings_admin, ldap_cfg)
+        self.assertIn(expected_group_mappings_viewer, ldap_cfg)
+        jane_req = self.query_grafana_website("janedoe", "crapper", "api/org/")
+        john_req = self.query_grafana_website("johndoe", "crapper", "api/org/")
+        self.assertEqual(jane_req.status_code, 401)
+        self.assertEqual(john_req.status_code, 200)
+        self.assertIn("name", john_req.json())
+
+    def test_24_remove_ldap_authentication(self):
+        """Disable LDAP authentication and validate that LDAP users can't login."""
+        config_file = LDAP_TOML[self.install_method]
+        model.set_application_config(self.application_name, {"ldap_auth": "false"})
+        model.block_until_unit_wl_status(self.lead_unit_name, "active")
+        model.block_until_all_units_idle()
+        expected_output = "cat: {}: No such file or directory".format(config_file)
+        ldap_cfg = model.run_on_unit(
+            self.lead_unit_name,
+            "cat %s" % config_file,
+        )
+        self.assertIn(expected_output, ldap_cfg["Stderr"])
+        john_req = self.query_grafana_website("johndoe", "crapper", "api/org/")
+        self.assertEqual(john_req.status_code, 401)
+
 
 class SnappedGrafanaTest(BaseGrafanaTest):
     """Verify Grafana installed as a snap."""
@@ -365,6 +560,8 @@ class SnappedGrafanaTest(BaseGrafanaTest):
         status_message = self.get_unit_status(self.lead_unit_name)
         self.assertIn("PACKAGE UPGRADE REQUIRES MANUAL INTERVENTION", status_message)
         action = model.run_action(self.lead_unit_name, "do-upgrade")
+        model.block_until_unit_wl_status(self.lead_unit_name, "active")
+        model.block_until_all_units_idle()
         self.assertEqual(action.data["status"], "completed")
         self.assertIn("Upgraded", action.data["results"]["result"])
 
diff --git a/src/tests/unit/requirements.txt b/src/tests/unit/requirements.txt
index cb975bd..42dfef1 100644
--- a/src/tests/unit/requirements.txt
+++ b/src/tests/unit/requirements.txt
@@ -7,3 +7,4 @@ requests
 jsondiff
 pbkdf2
 pycrypto
+netifaces