Skip to main content

​
After this article

You’ll be able to connect Grafana to Lumos to sync users, teams, organization roles, and team roles, and to provision organization and team roles.

​
Capabilities

Activity tracking is supported. The Grafana integration tracks the user’s last seen timestamp.

​
Required plan and roles

  • Grafana role: you can only connect the integration with a Service Account that has the User administration (organizational) role. This role gives Lumos both read and write capabilities.

​
Read-only access vs provisioning

Is read-only possible? No. Grafana only connects with a service account holding the User administration (organizational) role, and that role inherently grants Lumos both read and write access. No narrower, read-only role is documented for this connector. What full provisioning requires. A service account created with the User administration (organizational) role, with its token entered as the Service Account Token on the connector card along with your Grafana base URL. Follow the steps below. Watch out for. Because there’s only one supported role, you can’t scope this connection down to sync-only. Anyone who can generate the service account token can also provision Org Role and Team Role assignments.

​
Instructions

Phase 1: Create a Grafana service account token
  1. Log in to your Grafana account dashboard.
  2. Go to Administration → Users and access → Service accounts.
  3. Click Add service account and create a new service account with the User administration (organizational) role.
  4. Open the new service account’s settings and click Add service account token.
  5. Generate a new token. Copy and store it right away, because it might not be shown again.
Phase 2: Connect Grafana in Lumos
  1. Click the Grafana card in your Lumos integrations. Reconnect an existing card or add a new one.
  2. Provide the Service Account Token and the Base URL. Enter the base URL without the http:// or https:// protocol, for example your.grafana.com.
  3. Click Connect.

​
API Endpoints Used

​
Troubleshooting

“Unauthorized” or “Invalid authentication credentials”. Verify the token or API key is correct. Check that the token hasn’t expired or been revoked. “Forbidden” or “Permission denied”. Verify the service account has the required admin role and that the token has enough permission for the requested operations. Check that the organization ID is correct if one is specified. Cannot connect to the Grafana instance. Verify the Grafana URL is correct and reachable. Check network connectivity and firewall rules. Make sure HTTPS is configured correctly if you use SSL. Users aren’t syncing. Verify you have admin permission for user list access, that users are active in Grafana, and that users have email addresses configured. Teams are missing. Verify teams exist in the organization, that the token can access team data, and that teams have at least one member.