← Problem Library
Security L6 SECURITY-1323 · 13 min

A Grafana OAuth login works and role sync stays wrong because the identity provider renamed the group claim while Grafana still maps authorization from the old claim key

Users can authenticate, yet they land with the wrong role because the expected group claim is no longer in the token under the old name.

SecurityIAMPlatform ReliabilityLevel 6Pro13 min
Scenario

An IdP cleanup changes claim names and Grafana users later authenticate successfully but lose admin or editor access unexpectedly.

What to check first
  • Identify the primary failure signal in the IAM scenario.
  • Separate visible symptoms from the underlying technical dependency.
  • Describe the safest recovery path and the follow-up prevention work.
Checking checklist
  1. Summarize the current impact and the last known change.
  2. Collect direct evidence from logs, runtime state, and configuration before changing anything.
  3. Separate immediate recovery from permanent prevention work.
Recovery and prevention

Inspect token claim names and Grafana role mapping expressions before resetting user accounts.

Questions worth viewing together
What should you verify first when A Grafana OAuth login works and role sync stays wrong appears?

Community-field security problem inspired by Grafana community threads where OAuth role mapping broke after group claim names changed. Successful login does not prove authorization claims are still named the way the app expects.

What usually causes A Grafana OAuth login works and role sync stays wrong in production?

Teams often blame stale Grafana sessions when the IdP changed the group claim key.

What should you document after resolving A Grafana OAuth login works and role sync stays wrong?

SSO changes should validate both authentication and authorization claim contracts.