Grafana#

The Grafana instance of Critical Manufacturing MES, used by the Grafana widget and by the dashboards of Analytics Views, signs users in through the Security Portal.

Sign-In#

Grafana is configured during the installation as an OAuth client of the Security Portal, using the MES OAuth client and PKCE. Grafana has no separate user accounts or passwords:

• When a user opens Grafana, Grafana redirects them to the Security Portal to sign in. The Grafana sign-in form and sign-out menu are disabled.
• The first time a user signs in, Grafana creates the user automatically.

API Access#

The Grafana OAuth sign-in only supports interactive, browser-based sign-in. For an integration to call the Grafana API, Grafana also uses the JWT authentication ↗ strategy. Each request must include:

• The bearer token used to access the MES Host APIs.
• The X-JWT-Assertion header, with an ID token issued by the Security Portal. The Security Portal issues an ID token when the token endpoint is called with the openid scope.

Roles#

Grafana assigns each user a role from the MES features of the user:

Table: Grafana roles and MES features

If a user has both features, the Admin role applies. To grant a role, assign the corresponding feature to an MES role of the user. See Features.