LDAP Support, Metrics Separation, and Ingestion Token Concerns
TLDR Serhii inquired about LDAP support, separating metrics from different Prometheus instances, and concerns on user-linked tokens. Prabhat answered questions and provided possible solutions. Ryan raised concerns on security risks and shared suggestions.
Prabhat
Sun, 11 Jun 2023 12:16:15 UTC> Are you going to support LDAP?
Yes. Will be available soon.
> Is there a way to convert Grafana dashboard?
Not yet, We will be doing it soon. Please upvote -
Serhii
Sun, 11 Jun 2023 12:18:39 UTCAnd what is the best way to separate metrics from different Prometheus instances?
Prabhat
Sun, 11 Jun 2023 12:19:31 UTCI don't think I understand the question. Can you please elaborate, maybe with an example
Serhii
Sun, 11 Jun 2023 12:20:45 UTCFor example I have two Prometheus instances in two different clusters. Both have metric called “metric-name” in openobserve both of them will go into the same index
Serhii
Sun, 11 Jun 2023 12:21:39 UTCI’m from phone if the question is not clear, will do screenshot tomorrow :)
Prabhat
Sun, 11 Jun 2023 12:22:05 UTCah got it. I understand it now.
Prabhat
Sun, 11 Jun 2023 12:23:06 UTCcurrent possible solutions: 1. If they have different labels the you could use the labels to separate them
Prabhat
Sun, 11 Jun 2023 12:23:27 UTC2. You could push them in 2 different organizations
Prabhat
Sun, 11 Jun 2023 12:24:15 UTCBut this is a good scenario that requires more thinking and see if there can be a better solution
Serhii
Sun, 11 Jun 2023 12:24:20 UTCSo basically I can treat organisations as environments?
Serhii
Sun, 11 Jun 2023 12:24:32 UTCDev/prod/staging etc
Ryan
Sun, 11 Jun 2023 12:25:14 UTCI would strongly recommend against ldap support in product its a massive security risk, instead pick any idp and usesaml even a opensource one like keycloak
Ryan
Sun, 11 Jun 2023 12:25:42 UTCLDAP auth in app means your plain text passwords can be traced out
Prabhat
Sun, 11 Jun 2023 12:25:44 UTCRyan YEah, We will not build SSO directly
Prabhat
Sun, 11 Jun 2023 12:25:54 UTCmost likely we will pickup dex or something similar
Ryan
Sun, 11 Jun 2023 12:26:11 UTCSorry comment was to the OP its bad to even ask for this :slightly_smiling_face:
Ryan
Sun, 11 Jun 2023 12:27:10 UTCdex is what argocd uses, actual product ask support SCIMv2 provisioning out of the gate don't try the nonsense of mapping token claims alone
Serhii
Sun, 11 Jun 2023 12:27:45 UTCAnd one more question. Why do you use user credentials for metrics ingestion? For example I must create technical user to generate credentials for ingestion.
Serhii
Sun, 11 Jun 2023 12:28:57 UTCRyan why? Communication with ldap is going through ssl. Traffic is encrypted.
Prabhat
Sun, 11 Jun 2023 12:30:38 UTCWhile you can use the user id/password for ingestion we generally recommend ingestion token that you get from ingestion menu
Serhii
Sun, 11 Jun 2023 12:31:02 UTCI mean that token yes, but it still linked to user account
Serhii
Sun, 11 Jun 2023 12:32:02 UTCSo you have to create tech user, because you never know when someone will leave organization :) and if that user is deleted all configured ingestions will stop working
Serhii
Sun, 11 Jun 2023 12:32:31 UTCAnd I don’t think using admin account for that is a good idea
Prabhat
Sun, 11 Jun 2023 12:32:52 UTCfair point. We will think about it.
Ryan
Sun, 11 Jun 2023 12:37:52 UTCright ingestion is typically something that belongs to the org not the user, for integrations you often need both "org" level tokens with scoped rights that won't have to be changed and personal tokens for say something like a Jupyter notebook.
Prabhat
Sun, 11 Jun 2023 12:56:10 UTCOpen to suggestions on ingestion token generation-
OpenObserve
Indexed 419 threads
OpenObserve is an open-source, petabyte-scale observability platform for the cloud native realm, offering a 10x cost reduction and 140x less storage use compared to competitors like Elasticsearch or Splunk. Built in Rust for exceptional performance, it offers comprehensive features like logs, metrics, traces, dashboards, and more | Knowledge Base powered by Struct.AI
View in App
Serhii
Sun, 11 Jun 2023 12:12:02 UTCAre you going to support LDAP? Is there a way to convert Grafana dashboard? And another question do you plan to support dashboards and other stuff as a code like in Grafana?