Contact UsGet started
© 2025 Direct Cursus Technology L.L.C.

Creating an OIDC application in Yandex Identity Hub for integration with Grafana Cloud

Written by
Updated at November 12, 2025

Note

This feature is at the Preview stage.

Grafana Cloud is a managed cloud monitoring and observability platform that brings together Grafana, Prometheus, Loki, and other tools for data visualization and analysis. Grafana Cloud supports OpenID Connect (OIDC) authentication to provide secure SSO for your organization's users.

To authenticate your organization's users to Grafana Cloud with OpenID Connect SSO, create an OIDC app in Identity Hub and configure it appropriately both in Identity Hub and Grafana Cloud.

OIDC apps can be managed by users with the organization-manager.oauthApplications.admin role or higher.

For the users of your organization to be able to access Grafana Cloud:

  1. Create a Grafana Cloud account.
  2. Create an app.
  3. Set up the integration.
  4. Make sure the application works correctly.

Create a Grafana Cloud account

If you do not have a Grafana Cloud account, create one:

  1. Go to the Grafana Cloud sign up page.
  2. Fill out the registration form:
    • Enter your email address.
    • Create a secure password.
  3. Click Create my account.
  4. Verify your new account by following the instructions sent to the email address you provided.
  5. Select a name for your organization; this name will be part of your instance's URL, e.g., your-org.
  6. Once logged in, make sure you have administrator permissions to configure OIDC in your Grafana Cloud organization.
  7. Write down your Grafana Cloud instance’s URL, e.g., https://your-org.grafana.net, as you will need it to set up the integration.

Note

To configure OIDC in Grafana Cloud, you need organization administrator permissions. If you do not have the required permissions, contact your organization's administrator in Grafana Cloud.

Create an app

  1. Log in to Yandex Identity Hub.
  2. In the left-hand panel, select Apps.
  3. In the top-right corner, click Create application and in the window that opens:

    1. Select the OIDC (OpenID Connect) single sign-on method.

    2. In the Name field, specify a name for your new app: grafana-cloud-oidc-app.

    3. In the Folder field, select the folder where you want to create an OAuth client for your app.

    4. Optionally, in the Description field, enter a description for the new app.

    5. Optionally, add labels:

      1. Click Add label.
      2. Enter a label in key: value format.
      3. Press Enter.

    6. Click Create application.

Set up the integration

To integrate Grafana Cloud with the OIDC app you created in Identity Hub, complete the setup both on the Grafana Cloud side and in Identity Hub.

Configure your OIDC application in Yandex Identity Hub

Get the application’s credentials

  1. Log in to Yandex Identity Hub.

  2. In the left-hand panel, select Apps and then, the OIDC app.

  3. On the Overview tab, under Identity provider (IdP) configuration, expand the Additional attributes section and copy the parameter values you need to specify in Grafana Cloud:

    • ClientID: Unique application ID.
    • OpenID Configuration: URL with the configuration of all parameters required to set up the integration.

  4. Under App secrets, click Add secret, and in the window that opens:

    1. Optionally, add a description for the new secret.
    2. Click Create.

    The window will display the generated application secret. Save this value.

    Warning

    If you refresh or close the application information page, you will not be able to view the secret again.

    If you closed or refreshed the page before saving the secret, click Add secret to create a new one.

    To delete a secret, in the list of secrets on the OIDC app page, click in the secret row and select Delete.

Configure the redirect URI

  1. Log in to Yandex Identity Hub.

  2. In the left-hand panel, select Apps and then, the OIDC app.

  3. At the top right, click Edit and in the window that opens:

    1. In the Redirect URI field, specify the authentication endpoint for your Grafana Cloud instance formatted as follows:
    <Grafana_Cloud_instance_URL>/login/generic_oauth

    For example: https://your-org.grafana.net/login/generic_oauth.

    1. Click Save.

Set up the OIDC application in Grafana Cloud

To configure OpenID Connect authentication in Grafana Cloud, in the left-hand panel, navigate to Administration and then to Authentication.
In the main window, select Generic OAuth.

In the Generic OAuth settings:

  1. Under Name, specify OpenID Connect.
  2. In the Scopes field, enter the following, one by one: openid, email, profile.
  3. Under Client ID, specify the value you copied from the ClientID field when setting up the OIDC application in Identity Hub.
  4. In the Client Secret field, specify the value you copied from the App secrets section when setting up the OIDC application in Identity Hub.
  5. Click Enter OpenID Connect Discovery URL and then, in the window that opens, specify the URL you copied from the OpenID Configuration field when setting up the OIDC application in Identity Hub.
  6. Enable Allow sign up to automatically create users on first sign-in.

Add a user

For your organization's users to be able to authenticate in Grafana Cloud with Identity Hub's OIDC app, you need to explicitly add these users and/or user groups to the OIDC application.

Note

Users and groups added to an OIDC application can be managed by a user with the organization-manager.oidcApplications.userAdmin role or higher.

Add a user to the application:

  1. Log in to Yandex Identity Hub.
  2. In the left-hand panel, select Apps and select the required app.
  3. Navigate to the Users and groups tab.
  4. Click Add users.
  5. In the window that opens, select the required user or user group.
  6. Click Add.

Make sure your application works correctly

To make sure both your OIDC app and Grafana Cloud integration work correctly, authenticate to Grafana Cloud as one of the users you added to the app.

Proceed as follows:

  1. In your browser, navigate to the address of your Grafana Cloud instance, e.g., https://your-org.grafana.net.
  2. If you were logged in to Grafana Cloud, log out.
  3. On the Grafana Cloud sign in page, click Sign in with OpenID Connect.
  4. On the Yandex Cloud sign in page, enter the user email and password. The user or group they belong to must be added to the application.
  5. Make sure you are logged in to Grafana Cloud.
Previous
SAML
Next
Managed Service for OpenSearch