openlbac/lbac-proxy
Data-plane reverse proxy for OpenLBAC. Sits between visualization tool and your datasources
Image
Security
0
332
openlbac/lbac-proxy repository overview
lbac-proxy
Data plane for OpenLBAC. A reverse proxy that sits between Grafana and your datasources (Prometheus, Loki), rewriting queries at runtime to enforce per-group label-based access policies — no Grafana plugin, no datasource changes required.
Quick start
LBAC_CORE_URL=http://localhost:9090 \
IDENTITY_MODE=custom-idp \
CUSTOM_IDP_ADAPTER=grafana \
GRAFANA_URL=http://localhost:3000 \
GRAFANA_ADMIN_USER=admin \
GRAFANA_ADMIN_PASSWORD=admin \
go run ./cmd
Configuration
| Variable | Default | Description |
|---|---|---|
LBAC_CORE_URL | http://lbac-core:9090 | lbac-core address |
LISTEN_ADDR | :8080 | Listen address |
IDENTITY_MODE | custom-idp | custom-idp or oidc |
CUSTOM_IDP_ADAPTER | grafana | Adapter for custom-idp mode (grafana) |
GRAFANA_URL | http://grafana:3000 | Grafana base URL (custom-idp mode only) |
GRAFANA_ADMIN_USER | — | Grafana admin username |
GRAFANA_ADMIN_PASSWORD | — | Grafana admin password |
OIDC_ISSUER_URL | — | OIDC issuer URL (oidc mode only) |
OIDC_DISCOVERY_URL | — | OIDC discovery URL if different from issuer |
OIDC_GROUPS_CLAIM | groups | JWT claim path for groups (dot notation supported) |
OIDC_EMAIL_CLAIM | email | JWT claim path for email |
OIDC_AUDIENCE | — | Expected JWT audience |
IDENTITY_CACHE_TTL | 60s | Identity lookup cache TTL |
Docker
docker run -p 8080:8080 \
-e LBAC_CORE_ADDR=lbac-core:9090 \
-e IDENTITY_MODE=custom-idp \
-e CUSTOM_IDP_ADAPTER=grafana \
-e GRAFANA_URL=http://grafana:3000 \
openlbac/lbac-proxy:latest
Build
go build -o bin/lbac-proxy ./cmd
Documentation
Full configuration reference and deployment guides at openlbac.com.
License
Tag summary
Content type
Image
Digest
sha256:16e03a05f…
Size
12.5 MB
Last updated
5 months ago
docker pull openlbac/lbac-proxy