Grafana

A self-hosted Grafana signs in through Longbridge with its built-in generic OAuth support. Ten minutes, no GitHub or Google app.

1. Register the connected app

In the Console under Identity → Connected apps, register a confidential app with Grafana’s callback as the redirect URI — or from the terminal:

lbr identity app create grafana \
  --redirect-uri https://grafana.example.com/login/generic_oauth

Copy the client id and the client secret — the secret is shown once.

2. Configure Grafana

In grafana.ini (or the matching GF_AUTH_GENERIC_OAUTH_* environment variables):

[auth.generic_oauth]
enabled = true
name = Longbridge
client_id = <your client id>
client_secret = <your client secret>
scopes = openid profile email groups
auth_url = https://console.lngbrdg.com/api/auth/oauth2/authorize
token_url = https://console.lngbrdg.com/api/auth/oauth2/token
api_url = https://console.lngbrdg.com/api/auth/oauth2/userinfo
use_pkce = false
; Map Longbridge roles (the groups claim) to Grafana roles.
role_attribute_path = contains(groups[*], 'owner') && 'Admin' || contains(groups[*], 'org.admin') && 'Admin' || 'Viewer'
role_attribute_strict = false

Restart Grafana. The sign-in page grows a Sign in with Longbridge button.

3. Map roles

role_attribute_path is a JMESPath expression over the token’s claims. The groups claim carries the member’s Longbridge roles — built-ins like owner and org.admin, and custom roles by their hyphenated name. A common refinement:

role_attribute_path = contains(groups[*], 'grafana-admin') && 'Admin' || contains(groups[*], 'grafana-editor') && 'Editor' || 'Viewer'

Then define custom roles named Grafana Admin and Grafana Editor in Longbridge and grant them — role management in one place, effective at the next sign-in.

4. Lock the door (optional)

Grafana’s auto_assign_org admits any authenticated user — which is safe here, because only your organization’s members can authenticate. To narrow further, restrict the connected app itself:

lbr identity app update grafana --restrict-to-role platform-oncall

Members without the role are refused before Grafana ever sees them.