Configure Grafana LDAP authentication and role-based access control with Active Directory integration

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

# Global variables
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
LDAP_SERVER=""
BIND_DN=""
SEARCH_BASE=""
ADMIN_GROUP=""
EDITOR_GROUP=""
VIEWER_GROUP=""

# Usage information
usage() {
    echo -e "${BLUE}Usage: $0 [OPTIONS]${NC}"
    echo "Configure Grafana with LDAP authentication and role-based access control"
    echo
    echo "Required arguments:"
    echo "  --ldap-server SERVER     LDAP server hostname or IP"
    echo "  --bind-dn DN            Bind DN for LDAP authentication"
    echo "  --search-base BASE      LDAP search base"
    echo "  --admin-group GROUP     LDAP group for admin users"
    echo "  --editor-group GROUP    LDAP group for editor users"
    echo "  --viewer-group GROUP    LDAP group for viewer users"
    echo
    echo "Example:"
    echo "  $0 --ldap-server ldap.company.com --bind-dn 'CN=grafana,OU=Service Accounts,DC=company,DC=com' \\"
    echo "     --search-base 'DC=company,DC=com' --admin-group 'CN=GrafanaAdmins,OU=Groups,DC=company,DC=com' \\"
    echo "     --editor-group 'CN=GrafanaEditors,OU=Groups,DC=company,DC=com' \\"
    echo "     --viewer-group 'CN=GrafanaViewers,OU=Groups,DC=company,DC=com'"
    exit 1
}

# Logging functions
log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }

# Cleanup on failure
cleanup() {
    local exit_code=$?
    if [ $exit_code -ne 0 ]; then
        log_error "Installation failed. Performing cleanup..."
        systemctl stop grafana-server 2>/dev/null || true
        systemctl disable grafana-server 2>/dev/null || true
    fi
}
trap cleanup ERR

# Check if running as root or with sudo
check_privileges() {
    if [ "$EUID" -ne 0 ]; then
        log_error "Please run this script as root or with sudo"
        exit 1
    fi
}

# Auto-detect distribution
detect_distro() {
    if [ ! -f /etc/os-release ]; then
        log_error "/etc/os-release not found. Cannot detect distribution."
        exit 1
    fi
    
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_UPDATE="apt update"
            PKG_INSTALL="apt install -y"
            PKG_UPGRADE="apt upgrade -y"
            ;;
        almalinux|rocky|centos|rhel|ol)
            PKG_MGR="dnf"
            PKG_UPDATE="dnf check-update || true"
            PKG_INSTALL="dnf install -y"
            PKG_UPGRADE="dnf update -y"
            ;;
        fedora)
            PKG_MGR="dnf"
            PKG_UPDATE="dnf check-update || true"
            PKG_INSTALL="dnf install -y"
            PKG_UPGRADE="dnf update -y"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_UPDATE="yum check-update || true"
            PKG_INSTALL="yum install -y"
            PKG_UPGRADE="yum update -y"
            ;;
        *)
            log_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
    
    log_info "Detected distribution: $ID ($VERSION_ID)"
}

# Parse command line arguments
parse_args() {
    while [[ $# -gt 0 ]]; do
        case $1 in
            --ldap-server)
                LDAP_SERVER="$2"
                shift 2
                ;;
            --bind-dn)
                BIND_DN="$2"
                shift 2
                ;;
            --search-base)
                SEARCH_BASE="$2"
                shift 2
                ;;
            --admin-group)
                ADMIN_GROUP="$2"
                shift 2
                ;;
            --editor-group)
                EDITOR_GROUP="$2"
                shift 2
                ;;
            --viewer-group)
                VIEWER_GROUP="$2"
                shift 2
                ;;
            -h|--help)
                usage
                ;;
            *)
                log_error "Unknown option: $1"
                usage
                ;;
        esac
    done
    
    # Validate required arguments
    if [[ -z "$LDAP_SERVER" || -z "$BIND_DN" || -z "$SEARCH_BASE" || 
          -z "$ADMIN_GROUP" || -z "$EDITOR_GROUP" || -z "$VIEWER_GROUP" ]]; then
        log_error "All required arguments must be provided"
        usage
    fi
}

# Update system packages
update_system() {
    echo "[1/6] Updating system packages..."
    $PKG_UPDATE
    $PKG_UPGRADE
    log_info "System packages updated successfully"
}

# Install required dependencies
install_dependencies() {
    echo "[2/6] Installing dependencies..."
    case "$PKG_MGR" in
        apt)
            $PKG_INSTALL curl gnupg2 software-properties-common
            ;;
        dnf|yum)
            $PKG_INSTALL curl gnupg2
            ;;
    esac
    log_info "Dependencies installed successfully"
}

# Install Grafana
install_grafana() {
    echo "[3/6] Installing Grafana..."
    
    case "$PKG_MGR" in
        apt)
            # Add Grafana GPG key and repository
            curl -fsSL https://packages.grafana.com/gpg.key | gpg --dearmor -o /usr/share/keyrings/grafana.gpg
            echo "deb [signed-by=/usr/share/keyrings/grafana.gpg] https://packages.grafana.com/oss/deb stable main" > /etc/apt/sources.list.d/grafana.list
            $PKG_UPDATE
            $PKG_INSTALL grafana
            ;;
        dnf|yum)
            # Create Grafana repository file
            cat > /etc/yum.repos.d/grafana.repo << 'EOF'
[grafana]
name=grafana
baseurl=https://packages.grafana.com/oss/rpm
repo_gpgcheck=1
enabled=1
gpgcheck=1
gpgkey=https://packages.grafana.com/gpg.key
sslverify=1
sslcacert=/etc/pki/tls/certs/ca-bundle.crt
EOF
            $PKG_INSTALL grafana
            ;;
    esac
    
    log_info "Grafana installed successfully"
}

# Configure LDAP authentication
configure_ldap() {
    echo "[4/6] Configuring LDAP authentication..."
    
    # Create LDAP configuration file
    cat > /etc/grafana/ldap.toml << EOF
# LDAP Configuration for Grafana
[[servers]]
host = "$LDAP_SERVER"
port = 389
use_ssl = false
start_tls = true
ssl_skip_verify = false
bind_dn = "$BIND_DN"
bind_password = ''
search_filter = "(sAMAccountName=%s)"
search_base_dns = ["$SEARCH_BASE"]

[servers.attributes]
name = "givenName"
surname = "sn"
username = "sAMAccountName"
member_of = "memberOf"
email = "mail"

# Group mappings
[[servers.group_mappings]]
group_dn = "$ADMIN_GROUP"
org_role = "Admin"
grafana_admin = true

[[servers.group_mappings]]
group_dn = "$EDITOR_GROUP"
org_role = "Editor"
grafana_admin = false

[[servers.group_mappings]]
group_dn = "$VIEWER_GROUP"
org_role = "Viewer"
grafana_admin = false
EOF

    # Set correct permissions
    chown root:grafana /etc/grafana/ldap.toml
    chmod 640 /etc/grafana/ldap.toml
    
    log_info "LDAP configuration created successfully"
}

# Configure Grafana main settings
configure_grafana() {
    echo "[5/6] Configuring Grafana settings..."
    
    # Backup original configuration
    cp /etc/grafana/grafana.ini /etc/grafana/grafana.ini.backup
    
    # Update Grafana configuration to enable LDAP
    cat >> /etc/grafana/grafana.ini << 'EOF'

#################################### Auth LDAP ##########################
[auth.ldap]
enabled = true
config_file = /etc/grafana/ldap.toml
allow_sign_up = true

[users]
auto_assign_org = true
auto_assign_org_id = 1
auto_assign_org_role = Viewer
EOF

    log_info "Grafana configuration updated successfully"
}

# Start and enable services
start_services() {
    echo "[6/6] Starting and enabling Grafana service..."
    
    # Enable and start Grafana
    systemctl daemon-reload
    systemctl enable grafana-server
    systemctl start grafana-server
    
    # Wait for service to start
    sleep 5
    
    # Configure firewall if firewalld is active
    if systemctl is-active --quiet firewalld; then
        firewall-cmd --permanent --add-port=3000/tcp
        firewall-cmd --reload
        log_info "Firewall configured to allow Grafana (port 3000)"
    fi
    
    log_info "Grafana service started and enabled successfully"
}

# Verify installation
verify_installation() {
    echo
    echo "=== Installation Verification ==="
    
    # Check service status
    if systemctl is-active --quiet grafana-server; then
        log_info "✓ Grafana service is running"
    else
        log_error "✗ Grafana service is not running"
        return 1
    fi
    
    # Check if Grafana is listening on port 3000
    if ss -tlnp | grep -q ":3000"; then
        log_info "✓ Grafana is listening on port 3000"
    else
        log_error "✗ Grafana is not listening on port 3000"
        return 1
    fi
    
    # Check LDAP configuration file
    if [ -f /etc/grafana/ldap.toml ]; then
        log_info "✓ LDAP configuration file exists"
    else
        log_error "✗ LDAP configuration file missing"
        return 1
    fi
    
    echo
    echo -e "${GREEN}=== Installation Complete! ===${NC}"
    echo
    echo "Next steps:"
    echo "1. Access Grafana at: http://$(hostname -I | awk '{print $1}'):3000"
    echo "2. Default admin credentials: admin/admin (change on first login)"
    echo "3. Configure LDAP bind password in /etc/grafana/ldap.toml"
    echo "4. Test LDAP authentication with your Active Directory users"
    echo
    echo "Configuration files:"
    echo "- Grafana config: /etc/grafana/grafana.ini"
    echo "- LDAP config: /etc/grafana/ldap.toml"
    echo "- Logs: /var/log/grafana/grafana.log"
}

# Main execution
main() {
    check_privileges
    detect_distro
    parse_args "$@"
    
    log_info "Starting Grafana LDAP authentication setup..."
    
    update_system
    install_dependencies
    install_grafana
    configure_ldap
    configure_grafana
    start_services
    verify_installation
    
    log_info "Grafana LDAP authentication setup completed successfully!"
}

main "$@"