grafana: learn if github auth supports either org or team authorization

[consideRatio]

The grafana documentation on github auth wasn't clear with regards to if allowed_organizations and team_ids could be used together, or how a team id would be specified.

If we can verify that we can provide access to github teams as well besides access to us in the github org 2i2c-org, that will help when asking users if they want a certain group of users to be granted grafana access via github identities.

Related

• support chart / grafana setup: systematic use of github auth for 2i2c-org #2178

[GeorgianaElena]

@consideRatio, I believe there was some discussion or mention of some relevant docs of some sort in #1570

[colliand]

Thanks for creating this issue. I point this discussion out to @jmunroe as it overlaps with support discussions with Luis Lopez (betolink on GitHub). Once the technical issues are resolved, 2i2c Partnerships and Community should adapt this documentation which is mostly focused on 2i2c's internal usage to a wider scope that includes community usage of Grafana dashboards.

[yuvipanda]

https://infrastructure.2i2c.org/en/latest/sre-guide/support/grafana-account.html?highlight=grafana is the current method of giving out access to grafana for hub admins, and they can add other users there as desired.

[consideRatio]

I think we shouldn't dig into github based authentication further for grafana hubs, but instead resort to jupyterhub as an identity provider or settle with either github org or individual user/pass accounts.

Closing this for now.

[consideRatio]

I learned something more, and concluded that use of the GitHub API can reveal IDs of github organization's teams, and they can be used.

Messy though. To inspect things like this via the GitHub REST API, its nice to use gh the CLI.

For example, to get info about a github org you can do:

gh api /orgs/smithsonian