PROJECT 14 / IDENTITY & ACCESS
PRIVATE INFRASTRUCTURE / HYBRID IDENTITY
Nonproduction hybrid identity lab: secure a Linux-hosted application and validate cloud SSO end-to-end.
01 / ARCHITECTURE
Grafana OSS 13.3.0 runs on Ubuntu 26.04 LTS LINUX01 at 10.10.30.20 in an isolated home-lab Linux VLAN. Windows endpoint LT-JF01 reaches Grafana over pfSense OpenVPN. Active Directory DNS on DC01 resolves grafana.ad.jeremyfontenot.online to the private server address. This is a personal, nonproduction implementation—not a public Grafana service.
IDENTITY PATH / DOCUMENTED CONFIGURATION
Four connected controls, one private application.
LT-JF01 connects through pfSense OpenVPN; DC01 resolves the private Grafana hostname.
Ubuntu LINUX01 hosts the application behind trusted HTTPS on the Linux VLAN.
Single-tenant OAuth/OIDC sign-in returns to the configured Grafana callback.
Authorized user assignment and Grafana Viewer access are verified by retained records.
02 / DELIVERY
Demonstrated skills include Linux service administration, trusted HTTPS, Microsoft Entra application integration, identity verification, least-privilege access, and certificate lifecycle administration. Original screenshots and the retained lab record connect each skill to its configuration and result.
Diagnosed missing VPN route to VLAN 30, restricted Linux UFW SSH access to the VPN subnet, and authenticated to Ubuntu through SSSD using an Active Directory account. Installed Grafana through the signed Grafana APT repository and verified its health endpoint.
Issued a publicly trusted Let's Encrypt certificate through restricted Cloudflare DNS-01 credentials without publishing Grafana to the internet. Configured Grafana HTTPS on port 3000, secure cookies, and root-owned certificate copies readable by the Grafana group. A Certbot deployment hook copies renewed certificate material and restarts Grafana after successful renewal.
Registered single-tenant Grafana-OSS-SSO-Lab in Microsoft Entra; configured Grafana's built-in AzureAD provider, OAuth client credentials from a protected file, PKCE, token refresh, and an HTTPS callback. Kept the local administrator login as a recovery path.
Assigned the Entra test identity to the enterprise application, enabled Assignment required, published a branded Microsoft My Apps tile, and used the tile to launch Grafana.
03 / VERIFIED RESULTS
Microsoft Entra consent flow returned to an authenticated Grafana dashboard. Grafana Profile displayed attributes synchronized via AzureAD and explicitly showed organization role Viewer, despite the account's display name containing “Admin.”
Grafana /api/health responded with database ok over certificate-validated HTTPS. Certbot renew --dry-run --run-deploy-hooks succeeded; the hook ran, Grafana stayed healthy, and deployed certificate/key files matched Let's Encrypt originals.
Entra Enterprise Application showed the user assigned Default Access with Assignment required = Yes. The official Grafana-branded tile appeared in My Apps and opened Grafana. The follow-up profile displayed AzureAD as the session identity provider.
Read the implementation record, screenshot register, and validation matrix. Nineteen original screenshots below demonstrate the application, identity, authorization, and certificate configuration. The implementation record documents the command-based lab validation.
04 / ORIGINAL TECHNICAL EVIDENCE
Nineteen original PNGs selected after reviewing all 82 archive members (72 unique original screenshots plus ten curated copies). Every published file preserves its original bytes. Evidence register and SHA-256 hashes · Integrity manifest · Complete source inventory and selection reasons
P14-04
Observed: systemctl shows grafana-server enabled and active (running) on LINUX01.
Skill demonstrated: Enable a systemd application service and verify its running state.
Open original PNG: P14-04 — Grafana systemd service runningP14-04-Grafana-OSS-Systemd-Service-Running.pngP14-07
Observed: Grafana login is displayed at the configured HTTPS hostname and port without a visible browser certificate warning.
Skill demonstrated: Access the self-hosted Grafana application over HTTPS.
Open original PNG: P14-07 — Grafana HTTPS login pageP14-07-Grafana-HTTPS-TLS-Validated.pngP14-09
Observed: Grafana login displays Sign in with Microsoft Entra ID at the HTTPS application address.
Skill demonstrated: Present Microsoft Entra authentication on a self-hosted application login page.
Open original PNG: P14-09 — Microsoft Entra sign-in optionP14-09-Grafana-Microsoft-Entra-SSO-Login-Option.pngP14-10
Observed: Grafana home is displayed in an authenticated application view.
Skill demonstrated: Verify the authenticated application view alongside the AzureAD profile evidence.
Open original PNG: P14-10 — Authenticated Grafana dashboardP14-10-Grafana-Microsoft-Entra-SSO-Authentication-Success.pngP14-08
Observed: App overview shows Grafana-OSS-SSO-Lab, application/client ID, tenant ID, single-organization account type, and one Web redirect URI.
Skill demonstrated: Register a single-tenant relying-party application in Microsoft Entra.
Open original PNG: P14-08 — Single-tenant Entra app registrationP14-08-Entra-Grafana-App-Registration.pngP14-11
Observed: The Grafana account menu displays Jeremy Fontenot (Admin) and the expected Entra UPN.
Skill demonstrated: Verify the signed-in application account against the expected Entra identity.
Open original PNG: P14-11 — Signed-in user identityP14-11-Grafana-Entra-User-Identity-Verified.pngP14-D05
Observed: Microsoft requests basic profile and continued access for Grafana-OSS-SSO-Lab.
Skill demonstrated: Review application identity and requested permissions during OAuth consent.
Open original PNG: P14-D05 — OAuth consent promptP14-D05-Entra-OAuth-Consent-Prompt.pngP14-12
Observed: Profile fields are labeled Synced via AzureAD; Main Org. role is Viewer and the session provider is AzureAD.
Skill demonstrated: Verify AzureAD-synchronized attributes, session provider and least-privilege Viewer access.
Open original PNG: P14-12 — AzureAD profile and Viewer roleP14-12-Grafana-Entra-Role-Assignment-Verified.pngP14-13
Observed: Grafana-OSS-SSO-Lab lists Jeremy Fontenot (Admin) as User with Default Access.
Skill demonstrated: Assign an authorized identity to an Entra enterprise application.
Open original PNG: P14-13 — Explicit enterprise application assignmentP14-13-Entra-Grafana-Authorized-User-Assignment.pngP14-14
Observed: Enterprise application properties show Assignment required = Yes, visibility enabled, and a successful update notification.
Skill demonstrated: Configure an enterprise application to require explicit user assignment.
Open original PNG: P14-14 — Assignment required enabledP14-14-Entra-Grafana-Assignment-Required-Enabled.pngP14-15
Observed: Branding and properties show the Grafana logo and configured private HTTPS home-page URL.
Skill demonstrated: Configure application branding and the HTTPS launch address for My Apps.
Open original PNG: P14-15 — Application branding and launch URLP14-15-Entra-Grafana-Branding-Launch-URL.pngP14-17
Observed: The assigned user’s Apps dashboard contains the Grafana-OSS-SSO-Lab tile.
Skill demonstrated: Make an assigned enterprise application discoverable through Microsoft My Apps.
Open original PNG: P14-17 — Microsoft My Apps tileP14-17-Microsoft-MyApps-Grafana-SSO-Tile.pngP14-18
Observed: Grafana home is displayed in the capture supplied after the My Apps launch.
Skill demonstrated: Validate application access following the documented My Apps launch workflow.
Open original PNG: P14-18 — Grafana after My Apps launchP14-18-Microsoft-MyApps-Grafana-SSO-Launch-Success.pngP14-19
Observed: Grafana profile shows AzureAD-synchronized identity, Viewer role, and two AzureAD session entries.
Skill demonstrated: Verify AzureAD session identity and Viewer authorization following application launch.
Open original PNG: P14-19 — AzureAD session after launchP14-19-MyApps-Grafana-AzureAD-Session-Verified.pngP14-06
Observed: Certbot reports successfully received certificate, certificate/key paths, and expiration 2027-01-29.
Skill demonstrated: Issue a Let’s Encrypt certificate and identify its deployment paths and expiry.
Open original PNG: P14-06 — Let’s Encrypt certificate issuedP14-06-LetsEncrypt-Certificate-Issued.pngP14-16
Observed: Cloudflare token configuration limits permission to Zone DNS Edit for the specific jeremyfontenot.online zone.
Skill demonstrated: Scope Cloudflare DNS permissions to the specific certificate-validation zone.
Open original PNG: P14-16 — Cloudflare DNS permission scopeP14-16-Cloudflare-DNS01-Scoped-Permissions.pngP14-01
Observed: Ubuntu 26.04 LTS console shows login with the domain account and successful shell access.
Skill demonstrated: Authenticate to an Ubuntu host with an Active Directory account.
Open original PNG: P14-01 — LINUX01 Active Directory loginP14-01-LINUX01-Active-Directory-Login-Success.pngP14-02
Observed: The domain account resolves with id output and Active Directory group memberships on Linux.
Skill demonstrated: Verify Linux user identity and Active Directory group resolution.
Open original PNG: P14-02 — Active Directory identity and groupsP14-02-LINUX01-AD-Identity-Group-Validation.pngP14-03
Observed: LINUX01 SSH shell shows the domain-account prompt and private VLAN address 10.10.30.20.
Skill demonstrated: Administer a private Linux host through a domain-account SSH session.
Open original PNG: P14-03 — Domain account SSH sessionP14-03-LINUX01-Domain-SSH-Session.pngThis personal lab demonstrates secure administration of a private Linux application: Ubuntu and Grafana, Microsoft Entra OAuth/OIDC, Viewer authorization, explicit application assignment, Microsoft My Apps integration, and trusted HTTPS with a validated renewal simulation.
Grafana is reached through the private lab network. Certificate issuance uses Cloudflare DNS-01; application and DNS credentials remain protected on the server. The registered callback and lab configuration are documented in the implementation record.
