通过 Keycloak + Mysql 实现 Grafana 单点登录

灰太狼 2021-12-19 01:15 748阅读 0赞

### 注意: 文中提到的一些ip，端口，邮箱，用户名等信息为个人配置，请按实际自行修改 ###

# 1. docker 安装 mysql8.0.16 #

mysql端口使用3306

docker run --name mySql -p 3306:3306 --restart always -e MYSQL_ROOT_PASSWORD=root -d mysql:8.0.16

keycloak和grafana有独立的数据库，需要分别创建数据库，我就按这两个名称来命名。

# 2. docker 安装 keycloak #

keycloak端口使用9080

docker run --name myKeycloak -d --restart always --net keycloak-network -p 9080:8080 -e KEYCLOAK_USER=admin -e KEYCLOAK_PASSWORD=admin -e DB_VENDOR=mysql -e DB_ADDR=192.168.58.132 -e DB_PORT=3306 -e DB_DATABASE=keycloak -e DB_USER=root -e DB_PASSWORD=root jboss/keycloak

# 3. keycloak 配置 #

@ 登录Keycloak后台，比如 [http://192.168.58.132:9080/auth/][http_192.168.58.132_9080_auth] ，点击 [Administration Console ][Administration Console]，输入账号密码 admin/admin 登录。

@ Add Realm，比如Name为"Allen"

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xvbmRh_size_16_color_FFFFFF_t_70][]

@ 创建Client，Name为"grafana"，grafana默认端口是3000, 因此比如Root URL填写http://192.168.58.132:3000

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xvbmRh_size_16_color_FFFFFF_t_70 1][]

@ 开启Authorization Enabled，保存。（该步骤非必须，建议开启，可以提供鉴权功能）

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xvbmRh_size_16_color_FFFFFF_t_70 2][]

@ 打开Credentials，留存Secret，用于稍后配置grafana.ini。

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xvbmRh_size_16_color_FFFFFF_t_70 3][]

@ 到Users模块创建用户

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xvbmRh_size_16_color_FFFFFF_t_70 4][]

@ 到用户的Credentials页签设定密码，关闭Temporary选项。

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xvbmRh_size_16_color_FFFFFF_t_70 5][]

# 4. docker 安装 grafana #

docker run -d --restart always --net keycloak-network --user root --name=myGrafana -e "GF_SERVER_ROOT_URL=http://192.168.58.132:3000" -e "GF_SECURITY_ADMIN_PASSWORD=root" -p 3000:3000 -v "/mydata/docker/volume/grafana/lib:/var/lib/grafana" grafana/grafana

@ 访问 http://192.168.58.132:3000 即可看到登录界面，并可以通过 admin/root 登录。

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xvbmRh_size_16_color_FFFFFF_t_70 6][]

# 5. Grafana配置Oauth #

@ 编辑/etc/grafana/grafana.ini配置文件，需要进入docker中修改

主要修改三大块，Database，Security，Generic Oauth。如下三张图所示：

[database]
    # You can configure the database connection by specifying type, host, name, user and password
    # as separate properties or as on string using the url properties.
    
    # Either "mysql", "postgres" or "sqlite3", it's your choice
    type = mysql
    host = 192.168.58.132:3306
    name = grafana
    user = root
    # If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;"""
    password = root

mysql数据的jdbc配置，name是数据库名称grafana

[security]
    # default admin user, created on startup
    admin_user = admin
    
    # default admin password, can be changed before first start of grafana,  or in profile settings
    admin_password = root

admin\_user 和 admin\_password 估计是 grafana 用普通登录时的账号密码

[auth.generic_oauth]
    enabled = true
    name = Allen
    allow_sign_up = true
    client_id = grafana
    client_secret = 0f33ce60-6c66-4589-a952-cc630204c9af
    scopes = openid email name
    auth_url = http://192.168.58.132:9080/auth/realms/Allen/protocol/openid-connect/auth
    token_url = http://192.168.58.132:9080/auth/realms/Allen/protocol/openid-connect/token
    api_url = http://192.168.58.132:9080/auth/realms/Allen/protocol/openid-connect/userinfo

Allen 是 Realm Name 领域名称，在keyloak中创建Realm时指定的

grafana 是 client\_id，是在keyloak中创建client时指定的；

client\_secret 是 在client创建后自动生成的；

想查看整个配置文件，请参考文章  [grafana + mysql8.0.16 配置（运行成功）][grafana _ mysql8.0.16]

@ 重启docker grafana服务

@ 再次访问 http://192.168.58.132:3000 ，登录界面能看到"Sign in with Allen"，点击即跳转到Keycloak登录界面，Realm为Allen。使用账号密码 zhaolinliang / root登录，登录成功跳转回grafana，实现单点登录。

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xvbmRh_size_16_color_FFFFFF_t_70 7][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xvbmRh_size_16_color_FFFFFF_t_70 8][]

登录成功：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xvbmRh_size_16_color_FFFFFF_t_70 9][]

参考资料：

[Keycloak和Grafana集成实现单点登录][Keycloak_Grafana]

[http_192.168.58.132_9080_auth]: http://192.168.58.132:9080/auth/
[Administration Console]: http://192.168.58.132:9080/auth/admin/
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xvbmRh_size_16_color_FFFFFF_t_70]: /images/20211219/262f0e9e3df04e0da93e85f8f8fdc42f.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xvbmRh_size_16_color_FFFFFF_t_70 1]: /images/20211219/f2b0729a192b4a09b3f4564f06a72abe.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xvbmRh_size_16_color_FFFFFF_t_70 2]: /images/20211219/a2a4c26ca2c44294b8d52856feb31ac4.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xvbmRh_size_16_color_FFFFFF_t_70 3]: /images/20211219/843f6fd117e64875afe9aa50ba727780.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xvbmRh_size_16_color_FFFFFF_t_70 4]: /images/20211219/201f47a2f8cc413ca0e7ebb072ccd2de.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xvbmRh_size_16_color_FFFFFF_t_70 5]: /images/20211219/4c58841968574d44a655b57c360fbdc9.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xvbmRh_size_16_color_FFFFFF_t_70 6]: /images/20211219/599abc24a0684891922593ba82feffc9.png
[grafana _ mysql8.0.16]: https://blog.csdn.net/londa/article/details/94411208
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xvbmRh_size_16_color_FFFFFF_t_70 7]: /images/20211219/dac2f76889654a029d9f38a31575ef30.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xvbmRh_size_16_color_FFFFFF_t_70 8]: /images/20211219/7d2d5b28a2f04c39bac71af2ce3a53bc.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xvbmRh_size_16_color_FFFFFF_t_70 9]: /images/20211219/db27fc6cb292499eb591e3e209fa87d4.png
[Keycloak_Grafana]: http://tech.bejond.org/2018/03/26/Keycloak%E5%92%8CGrafana%E9%9B%86%E6%88%90%E5%AE%9E%E7%8E%B0%E5%8D%95%E7%82%B9%E7%99%BB%E5%BD%95/