---
alias: operation-guide-security-portal-integration-grafana
description: "Grafana signs users in through the Security Portal and maps MES features to Grafana roles."
---

# Grafana

The Grafana instance of Critical Manufacturing MES, used by the [[user-guide-uipage-widgets-grafana|Grafana widget]] and by the dashboards of [[user-guide-analytics-view-index|Analytics Views]], signs users in through the Security Portal.

## Sign-In

Grafana is configured during the installation as an OAuth client of the Security Portal, using the MES OAuth client and PKCE. Grafana has no separate user accounts or passwords:

* When a user opens Grafana, Grafana redirects them to the Security Portal to sign in. The Grafana sign-in form and sign-out menu are disabled.
* The first time a user signs in, Grafana creates the user automatically.

## API Access

The Grafana OAuth sign-in only supports interactive, browser-based sign-in. For an integration to call the Grafana API, Grafana also uses the [JWT authentication](https://grafana.com/docs/grafana/latest/setup-grafana/configure-access/configure-authentication/jwt/) strategy. Each request must include:

* The bearer token used to access the MES Host APIs.
* The `X-JWT-Assertion` header, with an ID token issued by the Security Portal. The Security Portal issues an ID token when the token endpoint is called with the `openid` scope.

## Roles

Grafana assigns each user a role from the MES features of the user:

| **MES Feature** | **Grafana Role** | **Description** |
| ----------- | ------------ | ----------- |
| `Grafana.Admin` | Admin | Can administrate Grafana dashboards. |
| `Grafana.Edit` | Editor | Can edit Grafana dashboards. |
| Neither feature | Viewer | Can view Grafana dashboards. |

Table: Grafana roles and MES features

If a user has both features, the Admin role applies. To grant a role, assign the corresponding feature to an MES role of the user. See [[user-guide-security-features]].