grafana.ini

[auth]
oauth_allow_insecure_email_lookup=true
oauth_auto_login = true
signout_redirect_url = https://auth.ocf.berkeley.edu/auth/realms/ocf/protocol/openid-connect/logout?redirect_uri=https%3A%2F%2Fgrafana.ocf.berkeley.edu%2F

[auth.generic_oauth]
enabled = true
client_id = grafana
auth_url = https://auth.ocf.berkeley.edu/auth/realms/ocf/protocol/openid-connect/auth
token_url = https://auth.ocf.berkeley.edu/auth/realms/ocf/protocol/openid-connect/token
api_url = https://auth.ocf.berkeley.edu/auth/realms/ocf/protocol/openid-connect/userinfo
scopes = openid profile email
allowed_domains = ocf.berkeley.edu
allow_sign_up = true
role_attribute_path = contains(groups[*], 'ocfroot') && 'Admin' || contains(groups[*], 'ocfstaff') && 'Editor' || 'Viewer'

# We don't need Grafana alerting, since we'll do it from Prometheus directly.
[alerting]
enabled = false

[session]
cookie_secure = true

[security]
cookie_secure = true