vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

docs/sso: name Grafana as the exception, and say it is unconditional

Browse source 
sso.md's "What this doesn't do" list opened with "It doesn't disable
local login" without qualification, which was wrong for Grafana before
the previous commit and is wrong in a different way after it: Grafana now
disables the form for every deployment, not just where authelia happens to
be on the same host.

Names the exception, gives the reason a reader can act on (a default
`admin`/`admin` account on a gateway-published vhost), and states the
consequence plainly — SSO is the only door, so a dead provider locks
everyone out, which is why the OIDC role defaults to Admin.
This commit is contained in:
atlas 2026-09-11 15:43:03 +02:00 • committed by mara
commit bafda6e3d5
1 changed files with 12 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

17
docs/swarm/sso.md
View file

@ -242,11 +242,18 @@ page-only check. This was verified that way when the split was introduced.
## What this doesn't do ## What this doesn't do
- **It doesn't disable local login.** Each service keeps its password - **It doesn't disable local login — except on Grafana.** Forgejo and
database and gains a second door. An identity provider that can take a tuwunel keep their password databases and gain a second door: an identity
service offline when it hiccups is worse than one with two ways in. provider that can take a service offline when it hiccups is worse than one
Making authelia the only path is a separate, reversible switch per with two ways in, and making authelia the only path there is a separate,
service (tuwunel's `login_with_password`, forgejo's own setting). reversible switch (tuwunel's `login_with_password`, forgejo's own setting).
⚠️ **Grafana is the exception, and not a reversible one.** Its module sets
`auth.disable_login_form` unconditionally, because Grafana ships an
`admin`/`admin` account and its vhost is on the public gateway — so a
password box there is a way in whatever the deployment. SSO is the only
door, and a dead provider locks everyone out, the built-in admin
included. That's why `swarm.grafana.oidc.role` defaults to `Admin`; see
[`services.md`](services.md#metrics-victoriametrics--grafana).
- **It doesn't provision users.** Agents are created and destroyed - **It doesn't provision users.** Agents are created and destroyed
continuously, so the subject set belongs to a program rather than to a continuously, so the subject set belongs to a program rather than to a
config file; today that program is `swarmctl`. config file; today that program is `swarmctl`.