从零开始系统学习 Go 编程

Appearance

权限管理 ​

Grafana 提供完善的权限管理系统，支持组织、团队和用户级别的权限控制。

权限体系 ​

权限层级 ​

Organization (组织)
       │
       ├─ Team (团队)
       │     └─ Team Members
       │
       ├─ User (用户)
       │     └─ User Role
       │
       └─ Resources (资源)
             ├─ Dashboard Permissions
             ├─ Folder Permissions
             └─ Data Source Permissions

权限类型 ​

权限说明范围
Admin完全管理权限组织、仪表板、数据源
Editor编辑权限仪表板、文件夹
Viewer只读权限仪表板、文件夹

用户管理 ​

用户角色 ​

角色权限
Admin组织管理、用户管理、系统配置
Editor创建和编辑仪表板、文件夹
Viewer查看仪表板、文件夹
None无权限

创建用户 ​

通过界面创建 ​

  1. 导航到 Configuration → Users
  2. 点击 New user
  3. 填写用户信息
  4. 分配角色

通过 API 创建 ​

bash
curl -X POST http://admin:admin@localhost:3000/api/admin/users \
  -H "Content-Type: application/json" \
  -d '{
    "name": "John Doe",
    "email": "john@example.com",
    "login": "john",
    "password": "password123",
    "OrgId": 1,
    "role": "Viewer"
  }'

更新用户 ​

bash
curl -X PATCH http://admin:admin@localhost:3000/api/users/2 \
  -H "Content-Type: application/json" \
  -d '{
    "name": "John Doe Updated",
    "email": "john.updated@example.com",
    "role": "Editor"
  }'

删除用户 ​

bash
curl -X DELETE http://admin:admin@localhost:3000/api/admin/users/2

组织管理 ​

创建组织 ​

bash
curl -X POST http://admin:admin@localhost:3000/api/orgs \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Development Team"
  }'

查询组织 ​

bash
# 列出所有组织
curl http://admin:admin@localhost:3000/api/orgs

# 获取当前组织
curl http://admin:admin@localhost:3000/api/org

更新组织 ​

bash
curl -X PUT http://admin:admin@localhost:3000/api/orgs/2 \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Dev Team Updated"
  }'

删除组织 ​

bash
curl -X DELETE http://admin:admin@localhost:3000/api/orgs/2

用户加入组织 ​

bash
curl -X POST http://admin:admin@localhost:3000/api/orgs/2/users \
  -H "Content-Type: application/json" \
  -d '{
    "loginOrEmail": "john",
    "role": "Editor"
  }'

团队管理 ​

创建团队 ​

bash
curl -X POST http://admin:admin@localhost:3000/api/teams \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Backend Team",
    "email": "backend@example.com"
  }'

查询团队 ​

bash
# 列出所有团队
curl http://admin:admin@localhost:3000/api/teams/search

# 获取团队成员
curl http://admin:admin@localhost:3000/api/teams/1/members

添加团队成员 ​

bash
curl -X POST http://admin:admin@localhost:3000/api/teams/1/members \
  -H "Content-Type: application/json" \
  -d '{
    "userId": 2
  }'

删除团队成员 ​

bash
curl -X DELETE http://admin:admin@localhost:3000/api/teams/1/members/2

仪表板权限 ​

权限级别 ​

权限说明
Admin完全控制仪表板
Edit编辑仪表板内容和设置
View只读访问仪表板

设置仪表板权限 ​

bash
curl -X POST http://admin:admin@localhost:3000/api/dashboards/id/1/permissions \
  -H "Content-Type: application/json" \
  -d '{
    "items": [
      {
        "teamId": 1,
        "permission": 1
      },
      {
        "userId": 2,
        "permission": 2
      }
    ]
  }'

权限值：

值权限
1View
2Edit
4Admin

获取仪表板权限 ​

bash
curl http://admin:admin@localhost:3000/api/dashboards/id/1/permissions

文件夹权限 ​

创建文件夹 ​

bash
curl -X POST http://admin:admin@localhost:3000/api/folders \
  -H "Content-Type: application/json" \
  -d '{
    "uid": "backend-folder",
    "title": "Backend Dashboards"
  }'

设置文件夹权限 ​

bash
curl -X POST http://admin:admin@localhost:3000/api/folders/1/permissions \
  -H "Content-Type: application/json" \
  -d '{
    "items": [
      {
        "teamId": 1,
        "permission": 2
      },
      {
        "userId": 3,
        "permission": 1
      }
    ]
  }'

继承权限 ​

json
{
  "items": [
    {
      "teamId": 1,
      "permission": 2,
      "inherit": true
    }
  ]
}

数据源权限 ​

设置数据源权限 ​

bash
curl -X POST http://admin:admin@localhost:3000/api/datasources/1/permissions \
  -H "Content-Type: application/json" \
  -d '{
    "items": [
      {
        "teamId": 1,
        "permission": 1
      },
      {
        "userId": 2,
        "permission": 2
      }
    ]
  }'

数据源权限值：

值权限
1Query (查询权限)
2Edit (编辑权限)
4Admin (管理权限)

全局数据源权限 ​

yaml
# 配置文件设置默认权限
[auth.anonymous]
enabled = true
org_name = Main Org.
org_role = Viewer

认证配置 ​

基础认证 ​

yaml
# grafana.ini
[auth]
disable_login_form = false
disable_signout_menu = false

[security]
admin_user = admin
admin_password = admin
secret_key = SW2YcwTIb9zpOOhoPsMm

LDAP 认证 ​

yaml
# grafana.ini
[auth.ldap]
enabled = true
config_file = /etc/grafana/ldap.toml

# ldap.toml
[[servers]]
host = "ldap.example.com"
port = 389
use_ssl = false
bind_dn = "cn=admin,dc=example,dc=com"
bind_password = "password"
search_filter = "(cn=%s)"
search_base_dns = ["dc=example,dc=com"]

[servers.attributes]
name = "givenName"
surname = "sn"
username = "cn"
email = "email"

OAuth 认证 ​

yaml
# grafana.ini - GitHub OAuth
[auth.github]
enabled = true
client_id = YOUR_CLIENT_ID
client_secret = YOUR_CLIENT_SECRET
scopes = user:email,read:org
auth_url = https://github.com/login/oauth/authorize
token_url = https://github.com/login/oauth/access_token
api_url = https://api.github.com/user
allowed_organizations = myorg

# grafana.ini - GitLab OAuth
[auth.gitlab]
enabled = true
client_id = YOUR_CLIENT_ID
client_secret = YOUR_CLIENT_SECRET
scopes = api
auth_url = https://gitlab.com/oauth/authorize
token_url = https://gitlab.com/oauth/token
api_url = https://gitlab.com/api/v4
allowed_groups = developers,admins

# grafana.ini - Google OAuth
[auth.google]
enabled = true
client_id = YOUR_CLIENT_ID
client_secret = YOUR_CLIENT_SECRET
scopes = https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/userinfo.email
auth_url = https://accounts.google.com/o/oauth2/auth
token_url = https://accounts.google.com/o/oauth2/token
api_url = https://www.googleapis.com/oauth2/v1/userinfo
allowed_domains = example.com

SAML 认证 ​

yaml
# grafana.ini
[auth.saml]
enabled = true
private_key_file = /path/to/private.key
certificate_file = /path/to/certificate.crt
idp_metadata_url = https://idp.example.com/metadata
idp_metadata_file = /path/to/idp_metadata.xml

权限最佳实践 ​

RBAC 配置 ​

  1. 最小权限原则：只授予必要的权限
  2. 团队分组：按职责创建团队，分配团队权限
  3. 文件夹组织：使用文件夹管理仪表板，设置文件夹权限
  4. 定期审查：定期检查和清理不必要的权限

推荐权限配置 ​

yaml
# 组织管理员
- role: Admin
  permissions: [manage users, manage org, manage dashboards]

# 团队 Leader
- role: Editor
  team: backend-team
  permissions: [edit dashboards in backend-folder]

# 团队成员
- role: Viewer
  team: backend-team
  permissions: [view dashboards in backend-folder]

# 外部用户
- role: Viewer
  permissions: [view public dashboards]

权限管理脚本 ​

bash
# 创建团队
curl -X POST http://admin:admin@localhost:3000/api/teams -d '{"name":"Backend Team"}'

# 创建文件夹
curl -X POST http://admin:admin@localhost:3000/api/folders -d '{"title":"Backend"}'

# 设置文件夹权限
curl -X POST http://admin:admin@localhost:3000/api/folders/1/permissions \
  -d '{"items":[{"teamId":1,"permission":2}]}'

# 创建用户并加入团队
curl -X POST http://admin:admin@localhost:3000/api/admin/users \
  -d '{"name":"Dev User","login":"devuser","password":"password"}'
curl -X POST http://admin:admin@localhost:3000/api/teams/1/members \
  -d '{"userId":2}'

参考：https://grafana.com/docs/grafana/latest/administration/