Access to your Sauron endpoints

An endpoint is a web address for a Sauron tool, such as Grafana or Console. This page helps you choose how to sign in to an endpoint. If you only want to view existing dashboards, start with browser access; you do not need an API token or a client credential.

Open the Grafana or Console URL from your welcome email or Console Endpoints.
Sign in with Oracle Single Sign-On (SSO). For a production Sauron, ask your Sauron owner which Oracle Identity Manager (OIM) entitlement to request. Viewer is the usual read-only role. After approval, sign out and back in.

Success: You can open the page you need without an access error. If access fails, check the URL and the status of your access request before using the troubleshooting guide.

Which access method should I use?

Choose the row for your task. If the endpoint or required role is unclear, ask your Sauron owner before requesting a credential or OIM access.

Auth and client quick reference

Use case	Recommended access method	Notes
Human user opening Grafana, OpenSearch Dashboards, Prometheus, Thanos, Alertmanager, API, Help, or Console in a browser	Oracle SSO	Request the correct OIM entitlement for the role and endpoint you need.
Grafana API automation	Grafana service account token	Grafana API keys also work, but they are deprecated in Grafana 9.1+.
OpenSearch log clients such as Fluentd, FluentBit, or other log shippers	Basic Authentication or approved Bearer token path	Reporter credentials can reach the OpenSearch data API, not OpenSearch Dashboards. See the endpoint matrix.
PushProx client	Basic Authentication or OAuth 2.0 Bearer token	Use the approved reporter credential or token for this client.
Sauron API automation	OAuth 2.0 Bearer token	Generate an admin-role Bearer token with `PUT /v1/oauth2/token`. The token API can be accessed only by Basic Auth admin users or users in the Admin OIM entitlement.

Success: You have the access method approved for the endpoint and can complete your intended read or write action. Browser access alone does not grant permission to change settings or send data.

Oracle SSO

Oracle SSO is enabled by default for production Sauron endpoints. To request access, follow OIM Entitlements. For sign-in checks, see Oracle SSO.

Basic Authentication

Basic Authentication uses a username and password. Sauron supports three account types:

Admin user - The initial administrator for your Sauron. Ask the Sauron owner how its credentials were delivered for your instance.
Secondary Admin user - An optional second administrator account. See create a Secondary Admin.
Reporter user - A limited account for log shippers and metrics proxy clients. Check the endpoint matrix before using it. If your Sauron needs one, follow create a Reporter.

Endpoint access matrix

This shows which endpoints accept local Basic Auth accounts. A Sauron reporter Bearer token follows the same Reporter endpoint list. Grafana service account tokens and Oracle SSO access have their own permissions; see the access methods above and OIM roles.

Endpoint	Admin or Secondary Admin	Reporter
Grafana	Yes	No
Prometheus and Prometheus Gateway	Yes	Yes
Alertmanager	Yes	No
Thanos UI	Yes	Yes
Thanos gRPC	Yes	Yes
Sauron API	Yes	No
Help	Yes	No
Console	Yes	No
OpenSearch data API	Yes	Yes
OpenSearch Dashboards	Yes	No
PushProx	Yes	Yes
Shuttleproxy	Yes	Yes

OpenSearch data API is for log clients; OpenSearch Dashboards is the browser interface. Ask your Sauron owner which credential is approved for your task.

Steps to create Secondary Admin User

You need Admin access to use this API. If you do not have it, ask the Sauron owner to create the account.

Go to PUT /v1/user/create API, click Try it Out and make sure secondary selected in dropdown.
Enter your password in password and confirmPassword fields and click Execute
Your Secondary Admin User is now created. You can use it to access any Sauron endpoint with admin access.
Username for Secondary Admin user is [Admin username] + [2]. e.g. if Admin username is test, Secondary Admin username will be test2

Steps to create Reporter User

You need Admin access to use this API. Ask your Sauron owner which client should use the account before creating it.

Go to PUT /v1/user/create API, click Try it Out and make sure reporter selected in dropdown.
Enter your password in password and confirmPassword fields and click Execute
Your Reporter User is now created. You can use it to configure your logs or metrics client.
Username for Reporter user is [Admin username] + [-reporter]. e.g. if Admin username is test, Reporter username will be test-reporter

Steps to reset password

Go to PUT /v1/user/password API, click Try it Out.
Enter userName, oldPassword, newPassword and confirmNewPassword and click Execute
After the API reports success, allow the endpoint configuration to update, then test the new password. If it still fails, check the API status and use the troubleshooting guide.

Basic Auth accounts may remain usable on supported endpoints alongside browser SSO. Verify access for the account and endpoint you intend to use.

OAuth 2.0 Bearer token

Grafana endpoint

Sauron supports both service account tokens (Grafana 9.1+) and API keys (deprecated) to access your Sauron Grafana API endpoints.

Service account token:

Open a Bash shell with bash before running the token examples below. Once you generate your service account token using Grafana UI, you can use this token to access your Grafana endpoint. e.g.

read -r -s -p 'Grafana service account token: ' GRAFANA_SERVICE_ACCOUNT_TOKEN; echo
curl --fail --show-error -H "Authorization: Bearer ${GRAFANA_SERVICE_ACCOUNT_TOKEN}" \
  'https://grafana.stage.apatil.developers.oracledx.com/api/org'

API key (deprecated in Grafana 9.1+):

Once you generate Grafana API key, use it to access your Grafana endpoint. (Note: API keys are deprecated. Grafana recommends using service account tokens) e.g.

read -r -s -p 'Legacy Grafana API key: ' GRAFANA_API_KEY; echo
curl --fail --show-error -H "Authorization: Bearer ${GRAFANA_API_KEY}" \
  'https://grafana.stage.apatil.developers.oracledx.com/api/org'

Non-Grafana endpoints

Sauron supports OAuth 2.0 Bearer token access to non-Grafana endpoints. Use Bearer tokens for Sauron API automation.

You can create a bearer token with one of the following roles:

admin (has full access to supported non-Grafana endpoints; use a Grafana service account token for Grafana API automation)
reporter (has access to the Reporter endpoints in the matrix)

You can create maximum 2 tokens for each role so that you can rotate them on client side without any down time:

admin1, admin2 tokens for admin role
reporter1, reporter2 tokens for reporter role

Use PUT /v1/oauth2/token API to generate a new OAuth 2.0 Bearer token for admin or reporter roles.

Once you generate a token, test it against a read-only Prometheus API endpoint available to both Admin and Reporter accounts. Expect HTTP 200:

read -r -s -p 'Sauron bearer token: ' SAURON_BEARER_TOKEN; echo
SAURON_BEARER_TOKEN_B64="$(printf '%s' "${SAURON_BEARER_TOKEN}" | base64 | tr '+/' '-_' | tr -d '\n')"

curl -o /dev/null -s -w '%{http_code}\n' \
  -H "Authorization: Bearer ${SAURON_BEARER_TOKEN_B64}" \
  'https://prometheus.stage.apatil.developers.oracledx.com/api/v1/status/buildinfo'

Note:

PUT /v1/oauth2/token API can be accessed only by basic-auth admin users or users that belong to [Team]Admin OIM entitlements. All other users will receive 403 Access Denied
Generating a new Bearer token using this API invalidates previous token for that role. e.g. if you generate new token for admin1, previous admin1 token is no longer valid. If you use old admin1 token to access your endpoint, you will receive 403 Access Denied.

Tips and checks

Tips: Use the account type required by the task. Keep passwords and tokens out of shared commands and screenshots.
Check: Confirm the endpoint and approved role using the access table. After an access change, sign out and back in. For command failures, check credentials or token expiry and the documented authentication format.