[Yandex Cloud documentation](../../../index.md) > [Yandex Identity Hub](../../index.md) > [Tutorials](../index.md) > [Setting up single sign-on (SSO) for apps](index.md) > Grafana OSS # Creating an OIDC application in Yandex Identity Hub for integration with Grafana OSS [Grafana Open Source Software (OSS)](https://grafana.com/oss/) is a free open-source data monitoring and visualization platform you can deploy on your own infrastructure. Grafana OSS supports [OpenID Connect](https://en.wikipedia.org/wiki/OpenID#OpenID_Connect_(OIDC)) (OIDC) authentication to provide secure SSO for your organization's users. To authenticate your [organization's](../../concepts/organization.md) users to Grafana OSS with OpenID Connect SSO, create an [OIDC app](../../concepts/applications.md#oidc) in Yandex Identity Hub and configure it appropriately both in Yandex Identity Hub and Grafana OSS. OIDC apps can be managed by users with the `organization-manager.oauthApplications.admin` [role](../../security/index.md#organization-manager-oauthApplications-admin) or higher. For the users of your organization to be able to access Grafana OSS: 1. [Create an app](#create-app). 1. [Set up the integration](#setup-integration). 1. [Make sure the application works correctly](#validate). ## Create an app {#create-app} {% list tabs group=instructions %} - Cloud Center UI {#cloud-center} 1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization). 1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps**. 1. In the top-right corner, click ![Circles3Plus](../../../_assets/console-icons/circles-3-plus.svg) **Create application** and in the window that opens: 1. Select the **OIDC (OpenID Connect)** single sign-on method. 1. In the **Name** field, specify a name for your new app: `grafana-oss-oidc-app`. 1. In the **Folder** field, select the folder where you want to create an OAuth client for your app. 1. Optionally, in the **Description** field, enter a description for the new app. 1. Optionally, add [labels](../../../resource-manager/concepts/labels.md): 1. Click **Add label**. 1. Enter a label in `key: value` format. 1. Press **Enter**. 1. Click **Create application**. - CLI {#cli} If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install). The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id ` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions. 1. See the description of the CLI command for creating an OIDC app: ```bash yc organization-manager idp application oauth application create --help ``` 1. Create an OAuth client: ```bash yc iam oauth-client create \ --name grafana-oss-oauth-client \ --scopes openid,email,profile,groups ``` Where: * `--name`: OAuth client name. * `--scopes`: User attributes that will be available to Grafana OSS. The specified attributes are: * `openid`: User ID. Required attribute. * `email`: User email address. * `profile`: Additional user details, such as first name, last name, and avatar. * `groups`: [User groups](../../concepts/groups.md) in the organization. Result: ```text id: ajeqqip130i1******** name: grafana-oss-oauth-client folder_id: b1g500m2195v******** status: ACTIVE ``` Save the `id` field value: you will need it to create and configure your app. 1. Create a secret for your OAuth client: ```bash yc iam oauth-client-secret create \ --oauth-client-id ``` Result: ```text oauth_client_secret: id: ajeq9jfrmc5t******** oauth_client_id: ajeqqip130i1******** masked_secret: yccs__939233b8ac**** created_at: "2025-10-21T10:14:17.861652377Z" secret_value: yccs__939233b8ac******** ``` Save the `secret_value` field value: you will need it to configure Grafana OSS. 1. Create an OIDC app: ```bash yc organization-manager idp application oauth application create \ --organization-id \ --name grafana-oss-oidc-app \ --description "OIDC application for integration with Grafana OSS" \ --client-id \ --authorized-scopes openid,email,profile,groups \ --group-distribution-type assigned-groups ``` Where: * `--organization-id`: [ID of the organization](../../operations/organization-get-id.md) you want to create your OIDC app in. This is a required setting. * `--name`: OIDC app name. This is a required setting. * `--description`: OIDC app description. This is an optional setting. * `--client-id`: OAuth client ID you got in Step 2. This is a required setting. * `--authorized-scopes`: Specify the same attributes as when creating the OAuth client. * `--group-distribution-type`: Specify `assigned-groups` to only provide groups added to the application to Grafana OSS. Result: ```text id: ek0o663g4rs2******** name: grafana-oss-oidc-app organization_id: bpf2c65rqcl8******** group_claims_settings: group_distribution_type: ASSIGNED_GROUPS client_grant: client_id: ajeqqip130i1******** authorized_scopes: - openid - email - profile - groups status: ACTIVE created_at: "2025-10-21T10:51:28.790866Z" updated_at: "2025-10-21T12:37:19.274522Z" ``` {% endlist %} ## Set up the integration {#setup-integration} To integrate Grafana OSS with the OIDC app you created in Yandex Identity Hub, complete the setup both on the Grafana OSS side and in Yandex Identity Hub. ### Configure your OIDC application in Yandex Identity Hub {#setup-idp} #### Get the application’s credentials {#get-credentials} {% list tabs group=instructions %} - Cloud Center UI {#cloud-center} 1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization). 1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps** and then, the OIDC app. 1. On the **Overview** tab, under **Identity provider (IdP) configuration**, expand the **Additional attributes** section and copy the parameter values you need to specify in Grafana OSS: * `ClientID`: Unique application ID. * `OpenID Configuration`: URL with the configuration of all parameters required to set up the integration. 1. Under **App secrets**, click **Add secret**, and in the window that opens: 1. Optionally, add a description for the new secret. 1. Click **Create**. The window will display the generated [application secret](../../concepts/applications.md#oidc-secret). Save this value. {% note warning %} If you refresh or close the application information page, you will not be able to view the secret again. {% endnote %} If you closed or refreshed the page before saving the secret, click **Add secret** to create a new one. To delete a secret, in the list of secrets on the OIDC app page, click ![ellipsis](../../../_assets/console-icons/ellipsis.svg) in the secret row and select ![trash-bin](../../../_assets/console-icons/trash-bin.svg) **Delete**. - CLI {#cli} If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install). The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id ` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions. 1. Get information about your new OIDC application: ```bash yc organization-manager idp application oauth application get ``` Where `` is your OIDC app ID you got when creating the app. This will return the application information, including the following: ```text id: ek0o663g4rs2******** name: grafana-oss-oidc-app organization_id: bpf2c65rqcl8******** client_grant: client_id: ajeqqip130i1******** authorized_scopes: - openid - email - profile - groups ``` Save the `client_id` value: this is the Client ID you will need to configure your Grafana OSS. 1. Get the OpenID Connect Discovery configuration URL: ```bash yc organization-manager idp application oauth application get \ --format json | jq -r '.client_grant.issuer_uri' ``` The result will look as follows: ```text https://auth.yandex.cloud/oauth/ ``` Save this URL: this is the OpenID Connect Discovery URL you will need to configure your Grafana OSS. 1. Use the OAuth client secret that you saved when creating the app in the previous step. If you have not saved the secret, create a new one: ```bash yc iam oauth-client-secret create \ --oauth-client-id ``` Save the `secret_value` from the command output: this is the Client Secret you will need to configure your Grafana OSS. {% endlist %} #### Configure the redirect URI {#setup-redirect} {% list tabs group=instructions %} - Cloud Center UI {#cloud-center} 1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization). 1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps** and then, the OIDC app. 1. At the top right, click ![pencil](../../../_assets/console-icons/pencil.svg) **Edit** and in the window that opens: 1. In the **Redirect URI** field, specify the authentication endpoint for your Grafana OSS instance formatted as follows: ```text /login/generic_oauth ``` 1. In the **Scopes** field, check the `groups (user's groups in the organization)` attribute and select `Assigned groups only`. 1. Click **Save**. - CLI {#cli} Update your OAuth client by providing the redirect URI: ```bash yc iam oauth-client update \ --id \ --redirect-uris "/login/generic_oauth" ``` Where: * ``: OAuth client ID you got when you created it. * `--redirect-uris`: Authentication endpoint for your Grafana OSS instance, e.g., `https://your-domain/login/generic_oauth`. Result: ```text id: ajeiu3otac08******** name: grafana-oss-oidc-app redirect_uris: - https://your-domain/login/generic_oauth scopes: - openid - email - profile - groups folder_id: b1gkd6dks6i1******** status: ACTIVE ``` {% endlist %} ### Set up the OIDC application in Grafana OSS {#setup-sp} To configure OpenID Connect authentication in Grafana OSS, in the left-hand panel, navigate to **Administration** and then to **Authentication**. In the main window, select **Generic OAuth**. In the Generic OAuth settings: 1. Under **Display name**, specify `OpenID Connect`. 1. Under **Client ID**, specify the value you copied from the **ClientID** field when setting up the OIDC application in Yandex Identity Hub. 1. In the **Client Secret** field, specify the value you copied from the **App secrets** section when setting up the OIDC application in Yandex Identity Hub. 1. In the **Scopes** field, enter the following, one by one: `openid`, `email`, `profile`, `groups`. 1. Click **Enter OpenID Connect Discovery URL** and then, in the window that opens, specify the URL you copied from the **OpenID Configuration** field when setting up the OIDC application in Yandex Identity Hub. 1. Enable **Allow sign up** to automatically create users on first sign-in. #### Configure role mapping {#role-mapping} {% note info %} Grafana OSS uses JMESPath expressions for role mapping. See [this Grafana guide for examples of using JMESPath expressions](https://grafana.com/docs/grafana/latest/setup-grafana/configure-access/configure-authentication/generic-oauth/#role-mapping-examples). {% endnote %} 1. Expand the **User mapping** section. 1. In the **Role attribute path** field, enter the JMESPath expression for role mapping. If you need to map the `Editor` role to a user in the `grafana-users` group, enter the following expression in the **Role attribute path** field: ```text contains(groups[*], 'grafana-users') && 'Editor' || 'Viewer' ``` The expression means the user will get the `Editor` role if they belong to the `grafana-users` group, and the `Viewer` role otherwise. #### Configure the redirect URI in Grafana OSS {#setup-redirect-grafana} The redirect URI you previously specified in Yandex Identity Hub must match the URI that Grafana OSS sends to Yandex Identity Hub. Follow these steps: 1. Open the [Grafana configuration file](https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#configuration-file-location). 1. In the `[server]` section, set: ```text root_url = https://your-domain ``` 1. [Restart](https://grafana.com/docs/grafana/latest/setup-grafana/start-restart-grafana/) Grafana OSS. ### Add a user {#add-user} For your organization's users to be able to authenticate in Grafana OSS with Yandex Identity Hub's OIDC app, you need to explicitly add these users and/or [user groups](../../concepts/groups.md) to the OIDC application. {% note info %} Users and groups added to an OIDC application can be managed by a user with the `organization-manager.oidcApplications.userAdmin` [role](../../security/index.md#organization-manager-oidcApplications-userAdmin) or higher. {% endnote %} Add a user to the application: {% list tabs group=instructions %} - Cloud Center UI {#cloud-center} 1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization). 1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps** and select the required app. 1. Navigate to the **Users and groups** tab. 1. Click ![person-plus](../../../_assets/console-icons/person-plus.svg) **Add users**. 1. In the window that opens, select the required user or user group. 1. Click **Add**. - CLI {#cli} If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install). The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id ` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions. 1. Get the [user ID](../../operations/users-get.md) or [user group ID](../../operations/group-get-id.md). 1. To add a user or user group to the app: 1. See the description of the CLI command for adding users to an app: ```bash yc organization-manager idp application oauth application add-assignments --help ``` 1. Run this command: ```bash yc organization-manager idp application oauth application add-assignments \ --id \ --subject-id ``` Where: * `--id`: OIDC app ID. * `--subject-id`: User or user group ID. Result: ```text assignment_deltas: - action: ADD assignment: subject_id: ajetvnq2mil8******** ``` {% endlist %} ## Make sure your application works correctly {#validate} To make sure both your OIDC app and Grafana OSS integration work correctly, authenticate to Grafana OSS as one of the users you added to the app. Follow these steps: 1. In your browser, navigate to the address of your Grafana OSS instance, e.g., `https://your-domain`. 1. If you were logged in to Grafana OSS, log out. 1. On the Grafana OSS sign in page, click **Sign in with OpenID Connect**. 1. On the Yandex Cloud sign in page, enter the user email and password. The user or group they belong to must be added to the application. 1. Make sure you have successfully authenticated in Grafana OSS. 1. If you have configured role mapping, go to the user profile in Grafana OSS and make sure the appropriate role is displayed under Organizations.