updates to scopes and comments #62
Conversation
manifest.yml
Outdated
| @@ -439,12 +440,12 @@ instance_groups: | |||
| # Monitoring auth | |||
| prometheus-staging: | |||
| <<: *client-template | |||
| scope: openid,email,profile | |||
| scope: openid,email,profile,prometheus.support,concourse.pages,concourse.admin | |||
There was a problem hiding this comment.
I'm not familiar with this part of the ops-login manifest; can you tell me more about the additional scopes being granted?
There was a problem hiding this comment.
I wasn't either before McG showed me. Basically we're making fine grain access to Grafana right now.
The new perm is prometheus.support, so named for a future ticket that will tackle prometheus itself. concourse.pages and concourse.admin are the overall perms currently given to platform folks and pages folks respectively.
So the perms are really just a new scope for uaa and a way to control access to Grafana, rather than just any uaa user.
There was a problem hiding this comment.
Ok, those roles make sense. Just to confirm — Is this configuring OpsUAA with scopes related to Prometheus? E.g. is this the full list of scopes related to Prometheus that can be assigned to users?
There was a problem hiding this comment.
No, this is the set for Grafana only. Prometheus will be in another ticket (currently in our IP backlog). So this will be the full list for Grafana.
manifest.yml
Outdated
| @@ -439,12 +441,12 @@ instance_groups: | |||
| # Monitoring auth | |||
| prometheus-staging: | |||
| <<: *client-template | |||
| scope: openid,email,profile | |||
| scope: openid,email,profile, prometheus-support, concourse.pages, concourse.admin | |||
There was a problem hiding this comment.
remove the spaces around the commas
manifest.yml
Outdated
| redirect-uri: https://prometheus.fr-stage.cloud.gov/oauth2/callback,https://alertmanager.fr-stage.cloud.gov/oauth2/callback,https://grafana.fr-stage.cloud.gov/oauth2/callback,https://grafana.fr-stage.cloud.gov/login/generic_oauth | ||
| secret: ((prometheus_client_secret_staging)) | ||
| prometheus-production: | ||
| <<: *client-template | ||
| scope: openid,email,profile | ||
| scope: openid,email,profile, prometheus-support, concourse.pages, concourse.admin |
There was a problem hiding this comment.
remove the spaces around the commas
Changes proposed in this pull request:
security considerations
None