From bafda6e3d59db7b935987c2bf958b3347259cebd Mon Sep 17 00:00:00 2001 From: atlas Date: Fri, 11 Sep 2026 15:43:03 +0200 Subject: [PATCH] docs/sso: name Grafana as the exception, and say it is unconditional MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit sso.md's "What this doesn't do" list opened with "It doesn't disable local login" without qualification, which was wrong for Grafana before the previous commit and is wrong in a different way after it: Grafana now disables the form for every deployment, not just where authelia happens to be on the same host. Names the exception, gives the reason a reader can act on (a default `admin`/`admin` account on a gateway-published vhost), and states the consequence plainly — SSO is the only door, so a dead provider locks everyone out, which is why the OIDC role defaults to Admin. --- docs/swarm/sso.md | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/docs/swarm/sso.md b/docs/swarm/sso.md index fe17e5b8..cb38d00a 100644 --- a/docs/swarm/sso.md +++ b/docs/swarm/sso.md @@ -242,11 +242,18 @@ page-only check. This was verified that way when the split was introduced. ## What this doesn't do -- **It doesn't disable local login.** Each service keeps its password - database and gains a second door. An identity provider that can take a - service offline when it hiccups is worse than one with two ways in. - Making authelia the only path is a separate, reversible switch per - service (tuwunel's `login_with_password`, forgejo's own setting). +- **It doesn't disable local login — except on Grafana.** Forgejo and + tuwunel keep their password databases and gain a second door: an identity + provider that can take a service offline when it hiccups is worse than one + with two ways in, and making authelia the only path there is a separate, + reversible switch (tuwunel's `login_with_password`, forgejo's own setting). + ⚠️ **Grafana is the exception, and not a reversible one.** Its module sets + `auth.disable_login_form` unconditionally, because Grafana ships an + `admin`/`admin` account and its vhost is on the public gateway — so a + password box there is a way in whatever the deployment. SSO is the only + door, and a dead provider locks everyone out, the built-in admin + included. That's why `swarm.grafana.oidc.role` defaults to `Admin`; see + [`services.md`](services.md#metrics-victoriametrics--grafana). - **It doesn't provision users.** Agents are created and destroyed continuously, so the subject set belongs to a program rather than to a config file; today that program is `swarmctl`.