Skip to main content

Grafana Keycloak SSO login: "User sync failed"

 

Background

Keycloak SSO authentication succeeds, but Grafana then rejects the login with "Login failed / User sync failed." Grafana receives a valid token and fails while creating the local user record.

Root cause: All GTAC LDAP users share one email address. Keycloak allows duplicate emails; Grafana requires them to be unique. The first account claims that email, and every SSO user after that fails to be created.

Also found: login_attribute_path = username doesn't match Keycloak's actual claim (preferred_username), so Grafana falls back to email as the username too.

We have no access to the GTAC LDAP interface, so the fix is limited to Keycloak and Grafana config. No LDAP or Keycloak email addresses change.

Environment: Grafana 10.4.11.13 | Keycloak 10.4.11.12:8444, realm databridge-web-service, client grafana | Generic OAuth

Reproduce: Authenticate to Keycloak → open Grafana → click "Sign in with DataBridge SSO" → "User sync failed."

Grafana Logs

logger=user.sync level=error msg="Failed to create user" error="user not found" auth_module=oauth_generic_oauth auth_id=d2755c01-8d70-4300-bec9-e6742798
logger=authn.service level=error msg="Failed to run post auth hook" client=auth.client.generic_oauth error="[user.sync.internal] unable to create user: user not found"

"User not found" is misleading — Grafana is trying to create the user, and the create fails on the duplicate email.

Acceptance Criteria

  1. Two different Keycloak users log in via SSO back to back, and both reach the Grafana home page.
  2. Each has a separate Grafana account with a unique email, and a username matching their Keycloak preferred_username.
  3. No Failed to create user or post auth hook errors in grafana.log during login.
  4. Each user gets the correct role (Admin/Editor/Viewer), and at least one SSO user is Admin.
  5. No emails changed in GTAC LDAP or Keycloak; the unique value exists only in Grafana's user table.
  6. The Keycloak email scope change affects the grafana client only.
  7. Rollback verified (restore grafana.ini + grafana.db, revert the Keycloak scope).
  8. After 1–7 pass, SSO-only login is enabled and both login and sign-out succeed.

Comments

Post a Comment

Popular posts from this blog

Joke of Day

Home / Blog / 35 Cybersecurity Jokes to Make Any Security Geek Chuckle (or Groan) 35 Cybersecurity Jokes to Make Any SecurityGeek Chuckle (or Groan) Posted on September 8, 2020 Last updated on December 13, 2024. Good IT jokes are few and far between, especially when it comes to cybersecurity. That’s why we put on our creativityhats to brainstorm joke after joke – with a break to pull in a few of our favorites from the web – for the ultimate result: themotherlode (or should we say mother board ?) of cybersecurity jokes and puns. P.S.: we side with Alfred Hitchcock on thisone: puns are the highest form of literature. Everyone deserves an eye-catching intro to break the ice at the start of a meeting or spice up a PowerPoint – gotta keepthe CEO’s attention somehow! And no joke is complete without the perfect graphic. Feel free to grab ours and includethem in your next newsletter, quarterly presentation, or for a workday pick-me-up. Without further ado, we present… Our Favorite Cybersecurit...
Post a Comment
Read more

Jira 6

  BRIEF Look at open-source AI security tools we can run safely on secdesk01, and decide whether any are worth adopting. DESCRIPTION Our scanners only catch what they have a pattern for. That means noise we have to sift through, and logic flaws they miss entirely. AI tools can reason about what they're seeing instead of just pattern-matching. This ticket is about finding out whether that helps us — using open-source tools we run ourselves, so our code and findings never leave our environment. Two things to investigate, both run sandboxed against Juice Shop on secdesk01: 1. Offensive — AI agents that test like a person would. They drive a terminal or browser, chain steps together, and find flaws that need context to spot. Because they send real attack traffic, they must be locked in with no route off the VM. Tools to look at: PentAGI, Strix, PentestGPT, Nebula, CAI. 2. Guardrails — the fencing that makes the above safe. Limits on what an agent is allowed to touch, blocking o...
Post a Comment
Read more