Configure Red Hat Ansible Automation Platform OAuth integration for Grafana

Register an OAuth2 application in Red Hat Ansible Automation Platform and configure Grafana and the UserInfo Proxy so that users can sign in to Grafana with their Red Hat Ansible Automation Platform credentials.

Before you begin

Procedure

  1. Register an OAuth2 application in your Red Hat Ansible Automation Platform instance and obtain the client ID and client secret.
  2. Edit /etc/flightctl/service-config.yaml: 
    grafana:
  oauth:
    enabled: true
    clientId: your-aap-oauth-client-id
    authUrl: https://your-aap.example.com/o/authorize/
    tokenUrl: https://your-aap.example.com/o/token/
    apiUrl: http://flightctl-userinfo-proxy:8080/userinfo
    scopes: read
  insecureSkipTlsVerify: false

  # Local admin account remains available as fallback
  localAdminUser: admin
  localAdminPassword: fallback-password

  # Optional server and plugin settings
  protocol: https
  allowedUnsignedPlugins:     # Comma-separated plugin IDs; leave empty for signed-only

userinfoProxy:
  upstreamUrl: https://your-aap.example.com/api/gateway/v1/me/
  insecureSkipTlsVerify: false
    • apiUrl must point to the UserInfo Proxy internal endpoint: http://flightctl-userinfo-proxy:8080/userinfo.
    • upstreamUrl must point to your Red Hat Ansible Automation Platform instance user API endpoint.
    • Set insecureSkipTlsVerify to true only in development environments that use self-signed certificates.
    • The local administrator account remains available as a fallback if OAuth is unavailable.
  3. Restart the observability services: 
    sudo systemctl restart flightctl-observability.target

Results

  1. Access the Grafana UI and confirm that the Red Hat Ansible Automation Platform OAuth sign-in option is available.
  2. Sign in with an Red Hat Ansible Automation Platform account and confirm that your Grafana role matches your Red Hat Ansible Automation Platform permissions, as described in OAuth integration with Red Hat Ansible Automation Platform.
  3. After you change any Grafana configuration, restart Grafana: 
    sudo systemctl restart flightctl-grafana.service