Contact UsTry it for free
© 2026 Direct Cursus Technology L.L.C.

Creating an OIDC application in Yandex Identity Hub for integration with Grafana OSS

Written by
Updated at January 13, 2026

Note

This feature is at the Preview stage.

Grafana Open Source Software (OSS) is a free open-source data monitoring and visualization platform you can deploy on your own infrastructure. Grafana OSS supports OpenID Connect (OIDC) authentication to provide secure SSO for your organization's users.

To authenticate your organization's users to Grafana OSS with OpenID Connect SSO, create an OIDC app in Identity Hub and configure it appropriately both in Identity Hub and Grafana OSS.

OIDC apps can be managed by users with the organization-manager.oauthApplications.admin role or higher.

For the users of your organization to be able to access Grafana OSS:

  1. Create an app.
  2. Set up the integration.
  3. Make sure the application works correctly.

Create an app

  1. Log in to Yandex Identity Hub.
  2. In the left-hand panel, select Apps.
  3. In the top-right corner, click Create application and in the window that opens:

    1. Select the OIDC (OpenID Connect) single sign-on method.

    2. In the Name field, specify a name for your new app: grafana-oss-oidc-app.

    3. In the Folder field, select the folder where you want to create an OAuth client for your app.

    4. Optionally, in the Description field, enter a description for the new app.

    5. Optionally, add labels:

      1. Click Add label.
      2. Enter a label in key: value format.
      3. Press Enter.

    6. Click Create application.

If you do not have the Yandex Cloud CLI installed yet, install and initialize it.

By default, the CLI uses the folder specified when creating the profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id parameter.

  1. See the description of the CLI command for creating an OIDC app:

    yc organization-manager idp application oauth application create --help

  2. Create an OAuth client:

    yc iam oauth-client create \
  --name grafana-oss-oauth-client \
  --scopes openid,email,profile,groups

    Where:

    • --name: OAuth client name.
    • --scopes: User attributes that will be available to Grafana OSS. The specified attributes are:
      • openid: User ID. Required attribute.
      • email: User email address.
      • profile: Additional user details, such as first name, last name, and avatar.
      • groups: User groups in the organization.

    Result:

    id: ajeqqip130i1********
name: grafana-oss-oauth-client
folder_id: b1g500m2195v********
status: ACTIVE

    Save the id field value: you will need it to create and configure your app.

  3. Create a secret for your OAuth client:

    yc iam oauth-client-secret create \
  --oauth-client-id <OAuth_client_ID>

    Result:

    oauth_client_secret:
  id: ajeq9jfrmc5t********
  oauth_client_id: ajeqqip130i1********
  masked_secret: yccs__939233b8ac****
  created_at: "2025-10-21T10:14:17.861652377Z"
secret_value: yccs__939233b8ac********

    Save the secret_value field value: you will need it to configure Grafana OSS.

  4. Create an OIDC app:

    yc organization-manager idp application oauth application create \
  --organization-id <organization_ID> \
  --name grafana-oss-oidc-app \
  --description "OIDC application for integration with Grafana OSS" \
  --client-id <OAuth_client_ID> \
  --authorized-scopes openid,email,profile,groups \
  --group-distribution-type assigned-groups

    Where:

    • --organization-id: ID of the organization you want to create your OIDC app in. This is a required setting.
    • --name: OIDC app name. This is a required setting.
    • --description: OIDC app description. This is an optional setting.
    • --client-id: OAuth client ID you got in Step 2. This is a required setting.
    • --authorized-scopes: Specify the same attributes as when creating the OAuth client.
    • --group-distribution-type: Specify assigned-groups to only provide groups added to the application to Grafana OSS.

    Result:

    id: ek0o663g4rs2********
name: grafana-oss-oidc-app
organization_id: bpf2c65rqcl8********
group_claims_settings:
  group_distribution_type: ASSIGNED_GROUPS
client_grant:
  client_id: ajeqqip130i1********
  authorized_scopes:
    - openid
    - email
    - profile
    - groups
status: ACTIVE
created_at: "2025-10-21T10:51:28.790866Z"
updated_at: "2025-10-21T12:37:19.274522Z"

Set up the integration

To integrate Grafana OSS with the OIDC app you created in Identity Hub, complete the setup both on the Grafana OSS side and in Identity Hub.

Configure your OIDC application in Yandex Identity Hub

Get the application’s credentials

  1. Log in to Yandex Identity Hub.

  2. In the left-hand panel, select Apps and then, the OIDC app.

  3. On the Overview tab, under Identity provider (IdP) configuration, expand the Additional attributes section and copy the parameter values you need to specify in Grafana OSS:

    • ClientID: Unique application ID.
    • OpenID Configuration: URL with the configuration of all parameters required to set up the integration.

  4. Under App secrets, click Add secret, and in the window that opens:

    1. Optionally, add a description for the new secret.
    2. Click Create.

    The window will display the generated application secret. Save this value.

    Warning

    If you refresh or close the application information page, you will not be able to view the secret again.

    If you closed or refreshed the page before saving the secret, click Add secret to create a new one.

    To delete a secret, in the list of secrets on the OIDC app page, click in the secret row and select Delete.

If you do not have the Yandex Cloud CLI installed yet, install and initialize it.

By default, the CLI uses the folder specified when creating the profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id parameter.

  1. Get information about your new OIDC application:

    yc organization-manager idp application oauth application get <app_ID>

    Where <app_ID> is your OIDC app ID you got when creating the app.

    This will return the application information, including the following:

    id: ek0o663g4rs2********
name: grafana-oss-oidc-app
organization_id: bpf2c65rqcl8********
client_grant:
  client_id: ajeqqip130i1********
  authorized_scopes:
    - openid
    - email
    - profile
    - groups

    Save the client_id value: this is the Client ID you will need to configure your Grafana OSS.

  2. Get the OpenID Connect Discovery configuration URL:

    yc organization-manager idp application oauth application get <app_ID> \
  --format json | jq -r '.client_grant.issuer_uri'

    The result will look as follows:

    https://auth.yandex.cloud/oauth/<OAuth_client_ID>

    Save this URL: this is the OpenID Connect Discovery URL you will need to configure your Grafana OSS.

  3. Use the OAuth client secret that you saved when creating the app in the previous step. If you have not saved the secret, create a new one:

    yc iam oauth-client-secret create \
  --oauth-client-id <OAuth_client_ID>

    Save the secret_value from the command output: this is the Client Secret you will need to configure your Grafana OSS.

Configure the redirect URI

  1. Log in to Yandex Identity Hub.
  2. In the left-hand panel, select Apps and then, the OIDC app.
  3. At the top right, click Edit and in the window that opens:

    1. In the Redirect URI field, specify the authentication endpoint for your Grafana OSS instance formatted as follows:

      <Grafana_OSS_instance_URL>/login/generic_oauth

    2. In the Scopes field, check the groups (user's groups in the organization) attribute and select Assigned groups only.

    3. Click Save.

Update your OIDC app by providing the redirect URI:

yc organization-manager idp application oauth application update <app_ID> \
  --redirect-uris "<Grafana_OSS_instance_URL>/login/generic_oauth"

Where:

  • <app_ID>: OIDC app ID you got when creating the app.
  • --redirect-uris: Authentication endpoint for your Grafana OSS instance. For example, https://your-domain/login/generic_oauth.

Result:

id: ek0o663g4rs2********
name: grafana-oss-oidc-app
organization_id: bpf2c65rqcl8********
redirect_uris:
  - https://your-domain/login/generic_oauth

Set up the OIDC application in Grafana OSS

To configure OpenID Connect authentication in Grafana OSS, in the left-hand panel, navigate to Administration and then to Authentication. In the main window, select Generic OAuth.

In the Generic OAuth settings:

  1. Under Display name, specify OpenID Connect.
  2. Under Client ID, specify the value you copied from the ClientID field when setting up the OIDC application in Identity Hub.
  3. In the Client Secret field, specify the value you copied from the App secrets section when setting up the OIDC application in Identity Hub.
  4. In the Scopes field, enter the following, one by one: openid, email, profile, groups.
  5. Click Enter OpenID Connect Discovery URL and then, in the window that opens, specify the URL you copied from the OpenID Configuration field when setting up the OIDC application in Identity Hub.
  6. Enable Allow sign up to automatically create users on first sign-in.

Configure role mapping

Note

Grafana OSS uses JMESPath expressions for role mapping. See this Grafana guide for examples of using JMESPath expressions.

  1. Expand the User mapping section.
  2. In the Role attribute path field, enter the JMESPath expression for role mapping.

If you need to map the Editor role to a user in the grafana-users group, enter the following expression in the Role attribute path field:

contains(groups[*], 'grafana-users') && 'Editor' || 'Viewer'

The expression means the user will get the Editor role if they belong to the grafana-users group, and the Viewer role otherwise.

Configure the redirect URI in Grafana OSS

The redirect URI you previously specified in Yandex Identity Hub must match the URI that Grafana OSS sends to Yandex Identity Hub.

Proceed as follows:

  1. Open the Grafana configuration file.

  2. In the [server] section, set:

    root_url = https://your-domain

  3. Restart Grafana OSS.

Add a user

For your organization's users to be able to authenticate in Grafana OSS with Identity Hub's OIDC app, you need to explicitly add these users and/or user groups to the OIDC application.

Note

Users and groups added to an OIDC application can be managed by a user with the organization-manager.oidcApplications.userAdmin role or higher.

Add a user to the application:

  1. Log in to Yandex Identity Hub.
  2. In the left-hand panel, select Apps and select the required app.
  3. Navigate to the Users and groups tab.
  4. Click Add users.
  5. In the window that opens, select the required user or user group.
  6. Click Add.

If you do not have the Yandex Cloud CLI installed yet, install and initialize it.

By default, the CLI uses the folder specified when creating the profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id parameter.

  1. Get the user ID or user group ID.

  2. To add a user or user group to the app:

    1. See the description of the CLI command for adding users to an app:

      yc organization-manager idp application oauth application add-assignments --help

    2. Run this command:

      yc organization-manager idp application oauth application add-assignments \
  --id <app_ID> \
  --subject-id <user_or_group_ID>

      Where:

      • --id: OIDC app ID.
      • --subject-id: User or user group ID.

      Result:

      assignment_deltas:
  - action: ADD
    assignment:
      subject_id: ajetvnq2mil8********

Make sure your application works correctly

To make sure both your OIDC app and Grafana OSS integration work correctly, authenticate to Grafana OSS as one of the users you added to the app.

Proceed as follows:

  1. In your browser, navigate to the address of your Grafana OSS instance, e.g., https://your-domain.
  2. If you were logged in to Grafana OSS, log out.
  3. On the Grafana OSS sign in page, click Sign in with OpenID Connect.
  4. On the Yandex Cloud sign in page, enter the user email and password. The user or group they belong to must be added to the application.
  5. Make sure you are logged in to Grafana OSS.
  6. If you have configured role mapping, go to the user profile in Grafana OSS and make sure the appropriate role is displayed under Organizations.
Previous
OpenID Connect
Next
1C:Enterprise