Manage authentication
Grafana Loki does not come with any included authentication layer. You must run an authenticating reverse proxy in front of your services.
The simple scalable and microservices deployment modes require a reverse proxy to be deployed in front of Loki, to direct client API requests to the various components.
By default the Loki Helm chart includes a default reverse proxy configuration, using an nginx container to handle routing traffic and authorization.
A list of open-source reverse proxies you can use:
- HAProxy
- NGINX using their guide on restricting access with HTTP basic authentication
- OAuth2 proxy
- Pomerium, which has a guide for securing Grafana
Note
When using Loki in multi-tenant mode, Loki requires the HTTP header
X-Scope-OrgIDto be set to a string identifying the tenant; the responsibility of populating this value should be handled by the authenticating reverse proxy. For more information, read the multi-tenancy documentation.
For information on authenticating Promtail, see the documentation for how to configure Promtail.
Was this page helpful?
Related resources from Grafana Labs
