Integrate Grafana with Zero Trust Network Access

In this topic, you will find general instructions on how to integrate Grafana with Portnox™ Zero Trust Network Access.

Create a Portnox Cloud application configuration

In this step, you will create a configuration in Portnox Cloud that will contain all the information necessary to integrate with Grafana.

  1. In a new tab of your browser, open your Portnox Cloud account by accessing the following URL: https://cloud.portnox.com/

    From now on, we will call this tab the Portnox tab.

  2. In the Cloud portal top menu, click on the Zero Trust Resources option.

  3. On the Resources screen, click on the Create resource button.

    1. In the What type of resource is this? section, select the SSO web application option.
    2. In the Authentication protocol section, select the SAML option.

    3. Click on the Next button.
  4. Optional: If you have more than one SAML identity provider configured, select the identity provider in the Select an identity provider to use for this resource section.
  5. In the Resource details section, enter a Resource name and optionally a Description.

    In this example, we used the name Grafana for the new application configuration but you can use any name you like.

  6. Keep this browser tab open. You will need it later.

Open your Grafana SAML configuration page

In this section, you will access your Grafana SAML configuration page and set up SAML SSO.

  1. In another tab of your browser, open your Grafana Cloud stack by accessing the following URL: https://your_stack.grafana.net/, where your_stack is your Grafana Cloud stack name.

    From now on, we will call this tab the Grafana tab.

  2. In the left-hand side menu, click on the Administration option, and then click on the Authentication option.

  3. On the Authentication screen, click on the SAML tile.

Copy configuration values from the Portnox tab to the Grafana tab

In this section, you will copy the identity provider metadata URL displayed by Portnox Cloud and paste it in the relevant field in the Grafana SAML configuration page.

  1. In the Portnox tab, in the Service details section, click on the  ⧉  icon next to the Identity Provider Entity ID / Audience URI field to copy the value.

  2. In the Grafana tab, on the Setup SAML single sign on page, click on the 3 Connect Grafana with Identity Provider step of the creator, in the IdP’s metadata field, select the URL for metadata option, then click on the empty field below the Metadata URL label and paste the value copied from Portnox Cloud.

Enter configuration values in the Portnox tab

In this section, you will enter configuration values in the relevant fields in Portnox Cloud.

  1. In the Portnox tab, in the Resource properties section, click on the empty field under the Entity ID / Service Provider Entity URL heading and enter the following value: https://your_stack.grafana.net/saml/metadata, where your_stack is your Grafana Cloud stack name.

  2. In the Portnox tab, in the Resource properties section, click on the empty field under the Assertion Consumer Service (ACS) URL / Reply URL heading and enter the following value: https://your_stack.grafana.net/saml/acs, where your_stack is your Grafana Cloud stack name.

Finalize the configuration

In this section, you will finalize the configuration in Portnox Cloud and Grafana.

  1. Finalize the configuration in the Portnox tab.
    1. Click on the OPTIONAL SETTINGS link to show additional fields, and then in the Application Login URI field, enter the following value: https://your_stack.grafana.net, where your_stack is your Grafana Cloud stack name.
      Note:
      This step is required if you want to show this application in the ZTNA Secure Access Portal.

    2. Optional: Click on the Next button, and in the Policy enforcement section, in the Device risk assessment section, change the setting to Override with custom policy and then select a risk assessment policy if you want to assess risk with this application using a custom risk assessment policy, and in the Access control section, change the setting to Override with custom policy and then select an access control policy if you want to control access to this application using a custom access control policy.
      Note:
      To configure the access control policy, follow the steps in this topic: Create or edit an access control policy. To select the default access control policy, on the Groups screen, select a group that you want to configure the default for, click on the  ⋮  icon at the end of the row that represents the group, and then select the Group policies option. Then, in the ZTNA Resources section, select the policy in the SSO Web resources drop-down menu.
    3. Scroll all the way down to the end of the page, and then click on the Add resource button.

  2. Finalize the configuration in the Grafana tab.
    1. Click on the 4 User mapping step of the creator, and then in the Assertion attributes mappings section, replace the value in the Name attribute field with $__saml{firstname} $__saml{lastname}.

      Important:

      You may need to configure your identity provider and Grafana to match the claims/attributes. A mismatch is likely to cause a Login provider denied login request error. You can configure the relevant fields in Grafana to match your existing claims/attributes or add new claims/attributes to your identity provider configuration. For an example of how to check and configure claims/attributes in your identity provider, see this guide for another application.

    2. Click on the 5 Test and enable step of the creator and then click on the Save and enable button.

      Grafana validates the configuration. If it finds an issue, it shows an error message. Correct the issue and click on the Save and enable button again.

      Once the configuration passes validation, the SAML integration status changes to Enabled.

Result: You have configured Grafana to be accessible using Portnox Zero Trust Network Access.