Skip to content

Commit

Permalink
moved info to FAQ (#1118)
Browse files Browse the repository at this point in the history
  • Loading branch information
catalinaadam authored Jul 18, 2023
1 parent 3c303e9 commit 9c256e0
Show file tree
Hide file tree
Showing 2 changed files with 20 additions and 14 deletions.
19 changes: 17 additions & 2 deletions docs/faq.md
Original file line number Diff line number Diff line change
Expand Up @@ -185,6 +185,21 @@ If you are using OVF/AMI, you can change the default password through SSH by usi
change-admin-password <new_password>
```

## How PMM handles personal and confidential data
## How does PMM handle personal and confidential data?

Read our [Privacy Policy](https://www.percona.com/privacy-policy) to learn how PMM manages personal and confidential data. More technical details can be found in [Data handling in PMM](details/personal_data_handling.md).
Read our [Privacy Policy](https://www.percona.com/privacy-policy) to learn how PMM manages personal and confidential data. More technical details can be found in [Data handling in PMM](details/personal_data_handling.md).

## Why am I getting a "User already exists" error when logging back into PMM?

Following [CVE fix 2023-3128](https://grafana.com/blog/2023/06/22/grafana-security-release-for-cve-2023-3128/) in the 2.38 release, PMM increases security by only allowing authentications based on the unique user ID provided by the identity provider.

If you are trying to log into PMM via a third-party authentication provider which doesn't support a unique ID field, PMM 2.38 and later will show this error on second and subsequent authentications.

**Solution**: we recommend logging into PMM using a Percona Account, as this is a highly secure authentication method.
**Workaround**: if you need to log into PMM via a third-party authentication provider which doesn’t support a unique ID field, you can use the following workaround to log into PMM:

- pass the `GF_AUTH_OAUTH_ALLOW_INSECURE_EMAIL_LOOKUP=1` environment variable to the PMM container **OR**
- set the `oauth_allow_insecure_email_lookup` config key in the auth section of the `grafana.ini` file. Keep in mind that any changes you make to this file are lost when upgrading PMM, so make sure to manually update this file after each upgrade.

!!! caution alert alert-warning "Important"
We do not recommend using the above workaround for an extended period. Instead, ensure user uniqueness across multiple identity providers, while also encouraging your identity provider to support a unique ID field, or choose a provider who does.
15 changes: 3 additions & 12 deletions docs/release-notes/2.38.1.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,15 +6,6 @@

Percona Monitoring and Management (PMM) is an open-source database monitoring, management, and observability solution for MySQL, PostgreSQL, and MongoDB.

## Release Highlights

With this update, we have fixed the "User already exists" error: an authentication issue that occurred when users tried to log back into PMM through a Percona Account. Second and subsequent logins no longer result in this error. This issue is a consequence of [CVE fix 2023-3128](https://grafana.com/blog/2023/06/22/grafana-security-release-for-cve-2023-3128/) included in PMM 2.38, which increases security by authenticating users based solely on the unique user ID provided by the identity provider.

We encourage you to log into PMM using a Percona Account, as this is a highly secure authentication method. However, if you need to log into PMM via a third-party authentication provider which doesn't support a unique ID field, you can use the following workaround to log into PMM:

- pass the `GF_AUTH_OAUTH_ALLOW_INSECURE_EMAIL_LOOKUP=1` environment variable to the PMM container **OR**
- set the `oauth_allow_insecure_email_lookup` config key in the auth section of the `grafana.ini` file. Keep in mind that any changes you make to this file are lost when upgrading PMM, so make sure to manually update this file after each upgrade.

!!! caution alert alert-warning "Important"
We do not recommend using the above workaround for an extended period of time. Instead, ensure user uniqueness across multiple identity providers, while also encouraging your identity provider to support a unique ID field, or choose a provider who does.

## Fixed issue
[PMM-12293](https://jira.percona.com/browse/PMM-12293) - With this update, we are fixing an authentication issue that occurred when trying to relog into PMM using a Percona Account.
Second and subsequent logins no longer result in a "User already exists" error.

0 comments on commit 9c256e0

Please sign in to comment.