Use Tailscale identity in your Grafana HTTP service

Integrate Border0 identity headers in Grafana by using Grafana's built-in auth.proxy feature. When users connect to Grafana through a Border0 HTTP socket, Border0 forwards Tailscale identity information in headers such as:

• X-Auth-Email
• X-Auth-Name
• X-Auth-Userid
• X-Auth-Username

Grafana can trust these headers for automatic single-sign on (SSO) access.

Enable Grafana configuration

In grafana.ini, enable the proxy identity provider and direct it to the X-Auth-Email header.

The following is a minimal grafana.ini configuration file:

[session]
cookie_secure = true

[users]
allow_sign_up = false
auto_assign_org = true
auto_assign_org_role = Admin

[auth]
disable_login_form = true
disable_signout_menu = true

[auth.anonymous]
enabled = false

[auth.basic]
enabled = false

[auth.proxy]
enabled = true
header_name = X-Auth-Email
header_property = username
auto_sign_up = true
headers = Email:X-Auth-Email

This configuration file directs Grafana to accept the Border0 HTTP header, automatically create users on first login, and assign the users to your organization.

Test with Docker

Using the configuration above, you can start Grafana and test the configuration.

1. On a device that is running Docker, run the following command:

   docker run -i \
   -v $(pwd)/grafana.ini:/etc/grafana/grafana.ini \
   -p 3000:3000 grafana/grafana
   

2. Create a new HTTP socket in Border0 and point it to your Grafana instance. If the socket is running on the same machine as your connector, use http://localhost:3000. Otherwise, modify as needed for your environment.

When users connect through your HTTP socket, they will automatically sign in to Grafana with their Tailscale identity.