The observability stack supports two authentication modes for Grafana: local authentication and OAuth integration with Red Hat Ansible Automation Platform.

Local authentication (default)

By default, Grafana uses local user accounts. Configure the administrator account and optional server settings in /etc/flightctl/service-config.yaml:

grafana:
  localAdminUser: admin
  localAdminPassword: secure-password
  # Optional server and plugin settings:
  protocol: https
  allowedUnsignedPlugins:     # Comma-separated plugin IDs; leave empty for signed-only

• localAdminUser and localAdminPassword: Administrator account credentials.
• protocol (default: https): Protocol Grafana uses for its server configuration. The Grafana root URL is generated as protocol://baseDomain:3000 (using the global baseDomain). Set protocol to http only in development without TLS. There is no separate rootUrl setting; the URL is always built from protocol and the global baseDomain.
• allowedUnsignedPlugins: Comma-separated list of Grafana plugin IDs that can load without a signature. Leave empty to allow only signed plugins (for example, grafana-piechart-panel,grafana-clock-panel).

To change the administrator password, edit /etc/flightctl/service-config.yaml and update the localAdminPassword field, then restart the Grafana service:

sudo systemctl restart flightctl-grafana.service

OAuth integration with Red Hat Ansible Automation Platform

For organizations that use Red Hat Ansible Automation Platform, you can configure Grafana to authenticate users through the Red Hat Ansible Automation Platform OAuth provider. This integration requires the UserInfo Proxy component and the same Red Hat Ansible Automation Platform platform version as Red Hat Edge Manager authentication integration. See Integrating with Red Hat Ansible Automation Platform in the Additional resources section for supported versions and prerequisites.

Ansible Automation Platform’s OAuth2 implementation uses a custom user API endpoint (/api/gateway/v1/me/) that returns user information in Ansible Automation Platform’s format, rather than the standard OpenID Connect UserInfo format that Grafana expects. The UserInfo Proxy acts as a translation layer that:

• Accepts OAuth tokens from Grafana.
• Queries the Red Hat Ansible Automation Platform user API with the token.
• Transforms Ansible Automation Platform’s response format into standard OAuth2 UserInfo format.
• Maps Red Hat Ansible Automation Platform user permissions (is_superuser, is_platform_auditor) to Grafana roles.

Without this proxy, Grafana cannot interpret Ansible Automation Platform’s user API responses and authentication fails.

The UserInfo Proxy maps Red Hat Ansible Automation Platform user permissions to Grafana roles:

See Configuring Red Hat Ansible Automation Platform OAuth integration for Grafana in the Additional resources section to set up this integration.