All Products
Search

This Product

    Application Real-Time Monitoring Service:Configure OAuth authentication for Grafana

    Document Center

    Application Real-Time Monitoring Service:Configure OAuth authentication for Grafana

    Last Updated:Jun 24, 2026

    Managed Service for Grafana supports user authentication and application authorization using the OAuth 2.0 protocol. This topic describes how to configure single sign-on for Grafana by using an Alibaba Cloud application as the identity provider.

    Background information

    OAuth (Open Authorization) is an open protocol that enables secure authorization for web, mobile, and desktop applications in a simple and standard way. Authorized applications can access protected resources without requiring user credentials. For more information, see the official OAuth documentation.

    After authorization, your self-hosted systems can access information stored in Managed Service for Grafana. This topic demonstrates the OAuth integration process by using an Alibaba Cloud system as the authorization provider. To authorize other types of accounts, see the official Grafana documentation.

    How it works

    image

    The following steps demonstrate how to use the Alibaba Cloud system to simulate the authorization system shown in the diagram. The configurations provided are for reference only. Ensure that your actual system settings comply with the OAuth 2.0 standard.

    Step 1: Create an application

    1. Log on to the RAM console with your Alibaba Cloud account.

    2. In the left-side navigation pane, choose Integrated Management > OAuth Applications Preview.

    3. On the Enterprise Applications tab, click Create Application.

    4. In the Create Application panel, configure the application parameters.

      1. Enter an Application Name and a Display name.

      2. Select an Application Type based on the following descriptions.

        Application type

        Description

        WebApp

        A web-based application that interacts through a browser.

        NativeApp

        A native application that runs on a desktop or mobile operating system.

        ServerApp

        An application that directly accesses Alibaba Cloud services without user logon. Currently, only user synchronization applications based on the System for Cross-domain Identity Management (SCIM) protocol are supported.

      3. Set the validity period for the Access Token Validity Period.

        Valid values: 900 seconds (15 minutes) to 10,800 seconds (3 hours). The default value is 3,600 seconds.

      4. For WebApp and NativeApp, set the validity period for the Refresh Token Validity Period and specify the Callback.

        • The validity period for the refresh token can range from 7,200 seconds (2 hours) to 31,536,000 seconds (1 year). The default value is 2,592,000 seconds.

        • The callback URL is the connection address of the Grafana workspace with the /login/generic_oauth suffix, for example, http://[Grafana connection address:port number]/login/generic_oauth. You can view the connection address and port number of the Grafana workspace on the Workspace Information page. For more information, see Create a Grafana workspace.

    5. Click Save.

    Step 2: Add a scope

    1. On the Enterprise Applications tab, click the name of your application.

      Note

      The Basic Information section on the application details page contains the application ID, which is required in Step 4.

    2. On the Application OAuth Scopes tab, click Add OAuth Scopes.

    3. In the Add OAuth Scopes panel, select the profile scope.

    4. Click OK.

    Step 3: Create an application secret

    1. On the application details page, click the App Secrets tab, and then click Create Secret.

    2. In the Create App Secret dialog box, click Copy to save the application secret, and then click close.

      Important

      • The application secret is shown only upon creation and cannot be retrieved later. Save it in a secure location.

      • You can create up to two application secrets for each application.

    Step 4: Modify workspace parameters

    1. Log on to the ARMS console. In the left-side navigation pane, choose Managed Service for Grafana > Workspace Management.

    2. On the Workspace Management page, click the ID of the workspace that you want to manage.

    3. In the left-side navigation pane, click Parameter Settings.

    4. In the parameter list on the left, select auth.generic_oauth, and then click Modify Parameters.

    5. In the Runtime Parameters column, modify the parameters with the following values, and then click Save and Apply.

      name = Alibaba
enabled = true
allow_sign_up = true
client_id = <Your application ID>      // The application ID from the Basic Information section in the RAM console.
client_secret = <Your application secret> // The application secret you created in Step 3.
scopes = openid profile
auth_url = https://signin.aliyun.com/oauth2/v1/auth
token_url = https://oauth.aliyun.com/v1/token
api_url = https://oauth.aliyun.com/v1/userinfo
email_attribute_path=login_name

    6. In the parameter list on the left, select server, and then click Modify Parameters.

    7. In the Runtime Parameters column, modify the parameters with the following values, and then click Save and Apply.

      root_url = http://[Your-Grafana-URL:Port]
      Note

      You can find the connection URL and port number of your Grafana workspace on the Workspace Information page.