Oracle SSO for Sauron Endpoints
Oracle Single Sign-On (SSO) is enabled by default for production Sauron endpoints. Your Oracle Identity Manager (OIM) entitlement determines what you can open or change. Start by asking your Sauron owner which entitlement you need; see OIM entitlements.
Check your access
- Open the Sauron endpoint you need from Console Endpoints.
- Sign in with Oracle SSO.
- Confirm you can open the page and perform the action your role allows.
Success: You can open the endpoint without an access error. If your access was just approved, sign out and back in before retrying. If it still fails, check your entitlement and follow login troubleshooting.
Who does what?
| Task | Who usually does it |
|---|---|
| Decide which users need Admin, Viewer, or Grafana Editor access | Sauron owner or customer team |
| Create new Sauron OIM entitlements | Sauron team |
| Approve or add users to existing OIM entitlements | OIM entitlement approver |
| Sign out and back in after an entitlement change | Affected user |
OIM role behavior
If a user belongs to multiple OIM entitlements, the higher-privileged role
takes precedence. For example, a Grafana user in both [Team]Editor and
[Team]Viewer receives Editor access.
| Entitlement | Access |
|---|---|
[Team]Admin |
Full access to the Sauron API endpoint. |
[Team]Viewer |
Read-only access to the Sauron API endpoint. Non-GET APIs return Access Denied. |
[Team]Editor |
Grafana Editor access for Grafana 8.x and above. |
If a user has no Sauron OIM entitlement, Sauron shows an access error in the browser. The exact message can vary. An OIM permission change takes effect after the user signs out and back in.
Endpoints that use Oracle SSO
Production Sauron browser endpoints include Alertmanager, API, Console, Grafana, Help, OpenSearch Dashboards, Prometheus, Thanos, and Thanos Rule. Use Console Endpoints to find the addresses available for your Sauron.
Grafana role notes
Grafana 7.x only
This is a legacy version. If your instance still runs Grafana 7.x, ask the Sauron team to confirm its role mapping before changing access. Do not apply the Grafana 8.x role steps to it.
Grafana 8.x and above
For Grafana 8.x and above, Sauron maps [Team]Admin, [Team]Editor, and
[Team]Viewer OIM entitlements to the corresponding Grafana roles. No extra
manual step is needed.
Tips and checks
- Tips: Use the intended corporate account. Keep command-line tokens in protected files.
- Check: For denied browser access, confirm the approved OIM entitlement and sign out and back in. For command failures, check token expiry and the documented token format.