Contact UsTry it for free
© 2025 Direct Cursus Technology L.L.C.

Creating an OIDC application in Yandex Identity Hub for integration with Grafana Cloud

Written by
Updated at December 19, 2025

Note

This feature is at the Preview stage.

Grafana Cloud is a managed cloud monitoring and observability platform that brings together Grafana, Prometheus, Loki, and other tools for data visualization and analysis. Grafana Cloud supports OpenID Connect (OIDC) authentication to provide secure SSO for your organization's users.

To authenticate your organization's users to Grafana Cloud with OpenID Connect SSO, create an OIDC app in Identity Hub and configure it appropriately both in Identity Hub and Grafana Cloud.

OIDC apps can be managed by users with the organization-manager.oauthApplications.admin role or higher.

For the users of your organization to be able to access Grafana Cloud:

  1. Create a Grafana Cloud account.
  2. Create an app.
  3. Set up the integration.
  4. Make sure the application works correctly.

Create a Grafana Cloud account

If you do not have a Grafana Cloud account, create one:

  1. Go to the Grafana Cloud sign up page.
  2. Fill out the registration form:
    • Enter your email address.
    • Create a secure password.
  3. Click Create my account.
  4. Verify your new account by following the instructions sent to the email address you provided.
  5. Select a name for your organization; this name will be part of your instance's URL, e.g., your-org.
  6. Once logged in, make sure you have administrator permissions to configure OIDC in your Grafana Cloud organization.
  7. Write down your Grafana Cloud instance’s URL, e.g., https://your-org.grafana.net, as you will need it to set up the integration.

Note

To configure OIDC in Grafana Cloud, you need organization administrator permissions. If you do not have the required permissions, contact your organization's administrator in Grafana Cloud.

Create an app

  1. Log in to Yandex Identity Hub.
  2. In the left-hand panel, select Apps.
  3. In the top-right corner, click Create application and in the window that opens:

    1. Select the OIDC (OpenID Connect) single sign-on method.

    2. In the Name field, specify a name for your new app: grafana-cloud-oidc-app.

    3. In the Folder field, select the folder where you want to create an OAuth client for your app.

    4. Optionally, in the Description field, enter a description for the new app.

    5. Optionally, add labels:

      1. Click Add label.
      2. Enter a label in key: value format.
      3. Press Enter.

    6. Click Create application.

If you do not have the Yandex Cloud CLI installed yet, install and initialize it.

By default, the CLI uses the folder specified when creating the profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id parameter.

  1. See the description of the CLI command for creating an OIDC app:

    yc organization-manager idp application oauth application create --help

  2. Create an OAuth client:

    yc iam oauth-client create \
  --name grafana-cloud-oauth-client \
  --scopes openid,email,profile

    Where:

    • --name: OAuth client name.
    • --scopes: User attributes that will be available to Grafana Cloud. The specified attributes are:
      • openid: User ID. Required attribute.
      • email: User email address.
      • profile: Additional user details, such as first name, last name, and avatar.

    Result:

    id: ajeqqip130i1********
name: grafana-cloud-oauth-client
folder_id: b1g500m2195v********
status: ACTIVE

    Save the id field value: you will need it to create and configure your app.

  3. Create a secret for your OAuth client:

    yc iam oauth-client-secret create \
  --oauth-client-id <OAuth_client_ID>

    Result:

    oauth_client_secret:
  id: ajeq9jfrmc5t********
  oauth_client_id: ajeqqip130i1********
  masked_secret: yccs__939233b8ac****
  created_at: "2025-10-21T10:14:17.861652377Z"
secret_value: yccs__939233b8ac********

    Save the secret_value field value: you will need it to configure your Grafana Cloud.

  4. Create an OIDC app:

    yc organization-manager idp application oauth application create \
  --organization-id <organization_ID> \
  --name grafana-cloud-oidc-app \
  --description "OIDC application for integration with Grafana Cloud" \
  --client-id <OAuth_client_ID> \
  --authorized-scopes openid,email,profile \
  --group-distribution-type none

    Where:

    • --organization-id: ID of the organization you want to create your OIDC app in. This is a required setting.
    • --name: OIDC app name. This is a required setting.
    • --description: OIDC app description. This is an optional setting.
    • --client-id: OAuth client ID you got in Step 2. This is a required setting.
    • --authorized-scopes: Specify the same attributes as when creating the OAuth client.
    • --group-distribution-type: Set to none as user groups are not provided to Grafana Cloud.

    Result:

    id: ek0o663g4rs2********
name: grafana-cloud-oidc-app
organization_id: bpf2c65rqcl8********
group_claims_settings:
  group_distribution_type: NONE
client_grant:
  client_id: ajeqqip130i1********
  authorized_scopes:
    - openid
    - email
    - profile
status: ACTIVE
created_at: "2025-10-21T10:51:28.790866Z"
updated_at: "2025-10-21T12:37:19.274522Z"

Set up the integration

To integrate Grafana Cloud with the OIDC app you created in Identity Hub, complete the setup both on the Grafana Cloud side and in Identity Hub.

Configure your OIDC application in Yandex Identity Hub

Get the application’s credentials

  1. Log in to Yandex Identity Hub.

  2. In the left-hand panel, select Apps and then, the OIDC app.

  3. On the Overview tab, under Identity provider (IdP) configuration, expand the Additional attributes section and copy the parameter values you need to specify in Grafana Cloud:

    • ClientID: Unique application ID.
    • OpenID Configuration: URL with the configuration of all parameters required to set up the integration.

  4. Under App secrets, click Add secret, and in the window that opens:

    1. Optionally, add a description for the new secret.
    2. Click Create.

    The window will display the generated application secret. Save this value.

    Warning

    If you refresh or close the application information page, you will not be able to view the secret again.

    If you closed or refreshed the page before saving the secret, click Add secret to create a new one.

    To delete a secret, in the list of secrets on the OIDC app page, click in the secret row and select Delete.

If you do not have the Yandex Cloud CLI installed yet, install and initialize it.

By default, the CLI uses the folder specified when creating the profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id parameter.

  1. Get information about your new OIDC application:

    yc organization-manager idp application oauth application get <app_ID>

    Where <app_ID> is your OIDC app ID you got when creating the app.

    This will return the application information, including the following:

    id: ek0o663g4rs2********
name: grafana-cloud-oidc-app
organization_id: bpf2c65rqcl8********
client_grant:
  client_id: ajeqqip130i1********
  authorized_scopes:
    - openid
    - email
    - profile

    Save the client_id value: this is the Client ID you will need to configure your Grafana Cloud.

  2. Get the OpenID Connect Discovery configuration URL:

    yc organization-manager idp application oauth application get <app_ID> \
  --format json | jq -r '.client_grant.issuer_uri'

    The result will look as follows:

    https://auth.yandex.cloud/oauth/<OAuth_client_ID>

    Save this URL: this is the OpenID Connect Discovery URL you will need to configure your Grafana Cloud.

  3. Use the OAuth client secret that you saved when creating the app in the previous step. If you have not saved the secret, create a new one:

    yc iam oauth-client-secret create \
  --oauth-client-id <OAuth_client_ID>

    Save the secret_value value from the command output: this is the Client Secret you will need to configure your Grafana Cloud.

Configure the redirect URI

  1. Log in to Yandex Identity Hub.

  2. In the left-hand panel, select Apps and then, the OIDC app.

  3. At the top right, click Edit and in the window that opens:

    1. In the Redirect URI field, specify the authentication endpoint for your Grafana Cloud instance formatted as follows:
    <Grafana_Cloud_instance_URL>/login/generic_oauth

    For example, https://your-org.grafana.net/login/generic_oauth.

    1. Click Save.

If you do not have the Yandex Cloud CLI installed yet, install and initialize it.

By default, the CLI uses the folder specified when creating the profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id parameter.

  1. Update your OIDC app by providing the redirect URI:

    yc organization-manager idp application oauth application update <app_ID> \
  --redirect-uris "<Grafana_Cloud_instance_URL>/login/generic_oauth"

    Where:

    • <app_ID>: OIDC app ID you got when creating the app.
    • --redirect-uris: Authentication endpoint for your Grafana Cloud instance. For example, https://your-org.grafana.net/login/generic_oauth.

    Result:

    id: ek0o663g4rs2********
name: grafana-cloud-oidc-app
organization_id: bpf2c65rqcl8********
redirect_uris:
  - https://your-org.grafana.net/login/generic_oauth

Set up the OIDC application in Grafana Cloud

To configure OpenID Connect authentication in Grafana Cloud, in the left-hand panel, navigate to Administration and then to Authentication.
In the main window, select Generic OAuth.

In the Generic OAuth settings:

  1. Under Name, specify OpenID Connect.
  2. In the Scopes field, enter the following, one by one: openid, email, profile.
  3. Under Client ID, specify the value you copied from the ClientID field when setting up the OIDC application in Identity Hub.
  4. In the Client Secret field, specify the value you copied from the App secrets section when setting up the OIDC application in Identity Hub.
  5. Click Enter OpenID Connect Discovery URL and then, in the window that opens, specify the URL you copied from the OpenID Configuration field when setting up the OIDC application in Identity Hub.
  6. Enable Allow sign up to automatically create users on first sign-in.

Add a user

For your organization's users to be able to authenticate in Grafana Cloud with Identity Hub's OIDC app, you need to explicitly add these users and/or user groups to the OIDC application.

Note

Users and groups added to an OIDC application can be managed by a user with the organization-manager.oidcApplications.userAdmin role or higher.

Add a user to the application:

  1. Log in to Yandex Identity Hub.
  2. In the left-hand panel, select Apps and select the required app.
  3. Navigate to the Users and groups tab.
  4. Click Add users.
  5. In the window that opens, select the required user or user group.
  6. Click Add.

If you do not have the Yandex Cloud CLI installed yet, install and initialize it.

By default, the CLI uses the folder specified when creating the profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id parameter.

  1. Get the user ID or user group ID.

  2. To add a user or user group to the app:

    1. See the description of the CLI command for adding users to an app:

      yc organization-manager idp application oauth application add-assignments --help

    2. Run this command:

      yc organization-manager idp application oauth application add-assignments \
  --id <app_ID> \
  --subject-id <user_or_group_ID>

      Where:

      • --id: OIDC app ID.
      • --subject-id: User or user group ID.

      Result:

      assignment_deltas:
  - action: ADD
    assignment:
      subject_id: ajetvnq2mil8********

Make sure your application works correctly

To make sure both your OIDC app and Grafana Cloud integration work correctly, authenticate to Grafana Cloud as one of the users you added to the app.

Proceed as follows:

  1. In your browser, navigate to the address of your Grafana Cloud instance, e.g., https://your-org.grafana.net.
  2. If you were logged in to Grafana Cloud, log out.
  3. On the Grafana Cloud sign in page, click Sign in with OpenID Connect.
  4. On the Yandex Cloud sign in page, enter the user email and password. The user or group they belong to must be added to the application.
  5. Make sure you are logged in to Grafana Cloud.
Previous
SAML
Next
Managed Service for OpenSearch