Can't use Authentik to log into Grafana

[Demigodrick]

Trying to put Authentik in front of Grafana. I have Authentik set up for a few other services and it works great, was no hassle to set up, but for some reason I can't work out why Grafana won't work. After I pass authentication with Authentik, Grafana takes me back to log in page with a message saying "internal server error". I've looked in the Grafana logs and get the following lines:

logger=oauth.generic_oauth t=2023-11-08T21:12:31.337222355Z level=debug msg="Getting user info"

logger=oauth.generic_oauth t=2023-11-08T21:12:31.337255688Z level=debug msg="Extracting user info from OAuth token"

logger=oauth.generic_oauth t=2023-11-08T21:12:31.338604017Z level=debug msg="Received id_token" raw_json="{\"iss\":\"https://auth.my.tld/application/o/grafana/\",\"sub\":\"<string>\",\"aud\":\"<string>\",\"exp\":1702069951,\"iat\":1699477951,\"auth_time\":1699476728,\"acr\":\"goauthentik.io/providers/oauth2/default\",\"at_hash\":\"<string>\"}" data="Name: , Displayname: , Login: , Username: , Email: , Upn: , Attributes: map[]"

logger=oauth.generic_oauth t=2023-11-08T21:12:31.338622652Z level=debug msg="Getting user info from API"

logger=oauth.generic_oauth t=2023-11-08T21:12:31.373113485Z level=debug msg="Error getting user info from API" url=https://auth.my.tld/application/o/userinfo/ error="unsuccessful response status code 403: "

logger=oauth.generic_oauth t=2023-11-08T21:12:31.373428955Z level=debug msg="Processing external user info" source=token data="Name: , Displayname: , Login: , Username: , Email: , Upn: , Attributes: map[]"

logger=oauth.generic_oauth t=2023-11-08T21:12:31.37344788Z level=debug msg="Unable to find user info name"

logger=oauth.generic_oauth t=2023-11-08T21:12:31.431842657Z level=error msg="Error getting email address" url=https://auth.my.tld/application/o/userinfo//emails error="unsuccessful response status code 404

logger=authn.service t=2023-11-08T21:12:31.432445633Z level=warn msg="Failed to authenticate request" client=auth.client.generic_oauth error="[auth.oauth.userinfo.error] failed to get user info: Error getting email address: unsuccessful response status code 404

Any help would be most appreciated! I've followed the steps from the Authentik page on Grafana: https://goauthentik.io/integrations/services/grafana/

[derfabianpeter]

I'm getting exactly the same error. Any ideas?

[Demigodrick]

I'm still out of luck, can't get it to work no matter what I've tried. I tried looking at the email 404 bit but as far as I can tell the setup is correct in Authentik.

[derfabianpeter]

Incidentally, I figured out that my issue was caused by having the scopes "openid email profile" in quotation marks inside my docker-compose file's environment section. After removing the quotes, things worked out just fine.

[Demigodrick]

Ah, no unfortunately they already don't have the quotation marks.

It has to be something to do with this line
'msg="Error getting email address" url=https://auth.my.tld/application/o/userinfo//emails error="unsuccessful response status code 404:'

I don't know why it would return a 404 (or why there is a double slash) - did you do anything different than the guide on the authentik page?

[fjih]

I hit the same error.

This turned out to be that the currently logged in Authentik user did not have an email address assigned to them. In the admin console of Authentik, if you browse to Directory\Users, ensure that your user has an email configured. This is not a required field. Be sure not to just open another tab and test as you'll likely be logged in as your Authenik admin account and perhaps not the user you're attempting to configure for Grafana. It's easiest to open a new private window to test from.

Grafana will then attempt to create a user with the same name and email with the username being the email. If you already have a Grafana user of the same name you'll get '"Failed to create user" error="user already exists"' in the Grafana logs. Just putting it out there since that's the next error I hit.

Best of luck.

[skuzzle]

Sharing my setup here as it is working flawlessly. Maybe it helps some of you to resolve your issues.

Env section for grafana in docker-compose.yml:

    environment:
    - GF_AUTH_GENERIC_OAUTH_ENABLED=true
    - GF_AUTH_GENERIC_OAUTH_CLIENT_ID__FILE=/run/secrets/grafana_sso_client_id
    - GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET__FILE=/run/secrets/grafana_sso_client_secret
    - GF_AUTH_GENERIC_OAUTH_AUTH_URL=https://<authentik-domain>/application/o/authorize/
    - GF_AUTH_GENERIC_OAUTH_TOKEN_URL=https://<authentik-domain>/application/o/token/
    - GF_AUTH_GENERIC_OAUTH_API_URL=https://<authentik-domain>/application/o/userinfo/
    - GF_AUTH_SIGNOUT_REDIRECT_URL=https://<authentik-domain>/application/o/grafana/end-session/
    - GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH=contains(groups[*], 'grafana-admins') && 'Admin' || contains(groups[*], 'grafana-editors') && 'Editor' || 'Viewer'
    - GF_AUTH_GENERIC_OAUTH_NAME=Authentik
    - GF_AUTH_GENERIC_OAUTH_SCOPES=openid profile email
    - GF_AUTH_OAUTH_AUTO_LOGIN=true

Note the I'm using Docker Swarm and resp. swarm secrets for injecting the Client Id and Client Secret.

In Authentik's Provider settings for Grafana you need to configure the following redirect URL: https://<grafana-domain>/login/generic_oauth.