Merge ~verterok/charm-grafana/+git/grafana-charm:support-auth-proxy-default-config into ~prometheus-charmers/charm-grafana:master

[Guillermo Gonzalez]

Add auth-proxy config and use it to render an active default config for auth.proxy

Add an option to enable default auth.proxy config, this is to use apache+apache-openid as the auth proxy.

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[Tom Haddon (mthaddon)]

Hi Guillermo,

Does auto_sign_up mean anyone will get access, or does that just mean if apache is configured to restrict to an SSO team that any member of that team will be able to create an account? What rights will users have that are created in this way?

review: Needs Information

[Tom Haddon (mthaddon)]

Also, what happens if you have auth-proxy configured as well as anonymous set to True? Should we make a note (and update code) to say that anonymous=True is ignored if you've set auth-proxy=True?

[Guillermo Gonzalez (verterok)]

> Hi Guillermo,
>
> Does auto_sign_up mean anyone will get access, or does that just mean if
> apache is configured to restrict to an SSO team that any member of that team
> will be able to create an account? What rights will users have that are
> created in this way?
Right, this is to be used with something like apache-openid so anyone allowed in the apache-openid config (team, list of openids, etc) can access it and a user will be created, using the openid url as the username (name and email can later be updated by the user, as apache-openid doesn't expose that information)

Regarding the rights users will have, as per the charm templates/grafana.ini.j2, users will get Viewer permissions (lines 125-129).

[Guillermo Gonzalez (verterok)]

> Also, what happens if you have auth-proxy configured as well as anonymous set
> to True? Should we make a note (and update code) to say that anonymous=True is
> ignored if you've set auth-proxy=True?

AFAIK, anonymous will not be ignored, it will not be used as long as the apache or other fe provides the X-WEBTEAM-USER header. if no header is present if will fallback to anonymous, if it's enabled. if will be also used for any url path not covered by openid, if you have any (e.g: API endpoint you don't want behind openid). for these cases would be better to have anonymous=False, which makes mandatory to get an API key to access the API.

[Tom Haddon (mthaddon)]

After some discussions on IRC, there's a little more testing/changes needed to figure out how to deal with admin rights. Marking as Needs Fixing pending those updates. Please "Resubmit" when ready for a follow up review.

review: Needs Fixing

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[Tom Haddon (mthaddon)]

A few comments inline.

[Guillermo Gonzalez (verterok)]

> A few comments inline.
Thanks, fixed and pushed

[Tom Haddon (mthaddon)]

LGTM, thanks!

review: Approve

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change successfully merged at revision 9d50a6994000b82c76fe44a786630c35aa61601a

diff --git a/README.md b/README.md
index c8b1234..8591ce1 100644
--- a/README.md
+++ b/README.md
@@ -68,6 +68,30 @@ To delete a user, you simply run:
 
  $ juju run-action --wait grafana/0 delete-user login=john
 
+
+#Auth proxy
+
+If deployed behind a reverse proxy, you can configure Grafana to let
+it handle authentication by enabled auth-proxy.
+
+ $ juju config grafana auth-proxy=true
+
+Check grafana [documentation](https://grafana.com/docs/auth/auth-proxy/#auth-proxy-authentication)
+on how to configure apache as the reverse proxy.
+
+Users will be created/signup automatically with "Viewer" permissions.
+To change the default permissions of a user, use the change-user-role
+action passing the openID identifier or the email if the user updated it 
+as the "login":
+
+ $ juju run-action --wait grafana/0 change-user-role \
+        login="[e-mail]" new-role="Admin"
+
+If not all URL paths are behind the reverse proxy auth,
+and `anonymous=true` is set, those paths will be accessible (view only) to
+non-authenticated users.
+
+
 #Development
 
 Explicitly set `JUJU_REPOSITORY`:
diff --git a/config.yaml b/config.yaml
index 5db3f1a..5456de8 100644
--- a/config.yaml
+++ b/config.yaml
@@ -115,6 +115,10 @@ options:
     default: 'Viewer'
     type: string
     description: The role given to anonymous users if enabled.
+  auth-proxy:
+    default: False
+    type: boolean
+    description: Whether to enable default auth.proxy config, defaults to False.
   datasources:
     default: ""
     type: string
diff --git a/templates/grafana.ini.j2 b/templates/grafana.ini.j2
index dbc9d86..06278fc 100644
--- a/templates/grafana.ini.j2
+++ b/templates/grafana.ini.j2
@@ -172,10 +172,17 @@ org_role = {{ config['anonymous_role'] }}
 
 #################################### Auth Proxy ##########################
 [auth.proxy]
+{% if config['auth-proxy'] -%}
+enabled = true
+header_name = X-WEBAUTH-USER
+header_property = username
+auto_sign_up = true
+{% else -%}
 ;enabled = false
 ;header_name = X-WEBAUTH-USER
 ;header_property = username
 ;auto_sign_up = true
+{% endif %}
 
 #################################### Basic Auth ##########################
 [auth.basic]