Menu
Enterprise
Authentication
Grafana Loki does not come with any included authentication layer. Operators are expected to run an authenticating reverse proxy in front of your services.
The simple scalable deployment mode requires a reverse proxy to be deployed in front of Loki, to direct client API requests to either the read or write nodes. The Loki Helm chart includes a default reverse proxy configuration, using Nginx.
A list of open-source reverse proxies you can use:
- Pomerium, which has a guide for securing Grafana
- NGINX using their guide on restricting access with HTTP basic authentication
- OAuth2 proxy
- HAProxy
Note
When using Loki in multi-tenant mode, Loki requires the HTTP headerX-Scope-OrgIDto be set to a string identifying the tenant; the responsibility of populating this value should be handled by the authenticating reverse proxy. For more information, read the multi-tenancy documentation.
For information on authenticating Promtail, see the documentation for how to configure Promtail.
Was this page helpful?
Related resources from Grafana Labs
5 Feb
Scaling and securing your logs with Grafana Loki
This webinar covers the challenges of scaling and securing logs, and how Grafana Enterprise Logs powered by Grafana Loki can help, cost-effectively.
60 min
Managing privacy in log data with Grafana Loki
Laws for data privacy are complex and rapidly changing. During this webinar, we will show how Grafana Loki can help organizations meet these requirements.
Blog post
The concise guide to Grafana Loki: Everything you need to know about labels
In Part 2 of "The concise guide to Loki," you'll learn about how to properly use labels in our favorite logging database.