Grafana 10 upgrade: OAuth login fails with "user already exists"

Not specified by the original author.

TL;DR

The users were created by OAuth in 9.x, and nothing in the OAuth config had changed. This is the documented Grafana v10 breaking change: OAuth integrations no longer look users up by email, which is how your 9.x users were matched.

When to use

You are seeing this: After upgrading Grafana 9.x to 10.0, existing users got Login Failed: user already exists when logging in through generic OAuth (ADFS, Keycloak, CILogon) or even Google OAuth. Use this skill when you run into "Grafana 10 upgrade: OAuth login fails with "user already exists"".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

What's going on

After upgrading Grafana 9.x to 10.0, existing users got Login Failed: user already exists when logging in through generic OAuth (ADFS, Keycloak, CILogon) or even Google OAuth. The users were created by OAuth in 9.x, and nothing in the OAuth config had changed. Rolling back to 9.x made it work again.

The verified fix

This is the documented Grafana v10 breaking change: OAuth integrations no longer look users up by email, which is how your 9.x users were matched. Existing accounts cant be found by email anymore, so the signup path fails with "user already exists".

The quick fix (marked insecure in the docs, so use with eyes open) is re-enabling email lookups in grafana.ini:

[auth]
oauth_allow_insecure_email_lookup = true

Multiple reporters confirmed this let their users log in again. The proper fix is making the login deterministic instead: set login_attribute_path (e.g. username for Keycloak) in [auth.generic_oauth] so Grafana matches users by the provider's login field rather than email, then you can leave the insecure lookup off.

How to use this

Take the question above and check if it matches what you're seeing. If it does, work through the verified fix step by step. Start with the cause described first, because that's what tells you the fix applies to your setup, then apply the changes in the order given. Verify by re-running whatever failed before, and expect the same behavior the thread author reported.

Someone asked: After upgrading Grafana 9.x to 10.0, existing users got Login Failed: user already exists when logging in through generic OAuth (ADFS, Keycloak, CILogon) or even Google OAuth. The users were created by OAuth in 9.x, and nothing in the OAuth config had changed. Rolling back to 9.x made it work again. The verified answer: This is the documented Grafana v10 breaking change: OAuth integrations no longer look users up by email, which is how your 9.x users were matched. Existing accounts cant be found by email anymore, so the signup path fails with "user already exists".

The quick fix (marked insecure in the docs, so use with eyes open) is re-enabling email lookups in grafana.ini:

[auth]
oauth_allow_insecure_email_lookup = true

Multiple reporters confirmed this let their users log in again. The proper fix is making the login deterministic instead: set login_attribute_path (e.g. username for Keycloak) in [auth.generic_oauth] so Grafana matches users by the provider's login field rather than email, then you can leave the insecure lookup off.

Source: https://github.com/grafana/grafana/issues/70203 Discussion and confirmation live at https://vectle.com/threads/thr_JQEujTlH2m9BbvZ5j78-KA

Not specified by the original author.

TL;DR

Fetch the existing object first and update it in place, or merge the duplicates and keep the record with the fuller history, instead of creating a second one. Start in the Grafana dashboard page, the alerting evaluation log, and the provisioning folder, work on one affected item, and prove the fix there before running the full set. Most cases of this failure clear once the value named in step 2 is corrected at its source rather than retried.

Grafana provisioning error: dashboard with the same uid already exists folder mismatch on startup

Use this when

• You see this exact message or symptom in Grafana: Grafana provisioning error: dashboard with the same uid already exists folder mismatch on startup
• One run, record, build, or object is affected and you can name it
• A retry without changing anything reproduces the same text

Not for this skill when

• Grafana fails with a different message and none of the signals here appear
• Nothing has failed yet and you are doing first time setup or general planning
• Every service from this vendor is down for all users, which is a vendor outage to wait out first

Steps

1. Reproduce the failure once in the Grafana dashboard page, the alerting evaluation log, and the provisioning folder and search the log or history for the exact text in the block above, recording the time, the workspace or project, and the one object it names. Verify: you have one failing run or object identified, not a similar older failure
2. Inspect the panel query and its data frame shape, the dashboard uid and folder, the data source plugin installation, and the service account role on the folder, and check the existing object id, the fields that differ between the copies, and the merge or update decision recorded for it. Verify: you can point to the specific value, field, or identity that does not match what this operation needs
3. Apply the fix at that source: fetch the existing object first and update it in place, or merge the duplicates and keep the record with the fuller history, instead of creating a second one. Verify: the corrected value or setting is visible in Grafana itself, not only in a local config file
4. Re-run the original operation on the single affected item first: save a copy of the dashboard under a test uid, fix the panel or provisioning entry, then promote the corrected dashboard. Verify: that one item completes with no trace of the error text from the block above
5. Check the downstream result a user or the next job would see: the panel rendering data, the alert rule evaluating without an error, and provisioning loading cleanly at restart. Verify: the downstream result agrees with the source for the test item, in value and in timestamp
6. Repeat for the full set, watch the first few items in the same log you started from, and write the root cause and the changed setting into the run notes. Verify: the full run finishes, the notes name the error and the changed setting, and no earlier item regressed

Variant phrasings

Grafana provisioning error: dashboard with the same uid already exists folder mismatch on startup

The subject-first phrasing of the same failure. The fix is the same, start at step 1 and confirm the object the log names.

Grafana version of this failure

The tool-first phrasing searchers use once they know which system raised it. It is the same underlying problem, not a separate bug.

Why does grafana provisioning error: dashboard with the same uid already exists folder mismatch on startup keep happening after a retry

The repeat-occurrence phrasing. A retry without the step 2 and step 3 checks almost always reproduces it, because the cause sits in the object state, not in the attempt.

Compatibility: Grafana 10 or 11, provisioned dashboards, unified alerting, data source plugins. The steps assume you can read the job or build log and change the named object in Grafana.

Why it happens

In Grafana, this failure usually means a create was issued for something that already exists under the same name, id, or key, so the service refused it or counted it twice. The visible message is raised at the point where the bad state is consumed, which is rarely where it was created, so fixing the message text or retrying the last step changes nothing. Correcting the state at its source, then re-running one item and comparing the downstream result against the source, is what separates a real fix from a run that only looks successful.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstk-eRC4Bu0As5Te-8FolyQ

Resolved from the public thread: https://vectle.com/posts/pstk-eRC4Bu0As5Te-8FolyQ

Thread query: Grafana provisioning error: dashboard with the same uid already exists folder mismatch on startup

TL;DR: Fetch the existing object first and update it in place, or merge the duplicates and keep the record with the fuller history, instead of creating a second one. Start in the Grafana dashboard page, the alerting evaluation log, and the provisioning folder, work on one affected item, and prove the fix there before running the full set. Most cases of this failure clear once the value named in step 2 is corrected at its source rather than retried.

Not specified by the original author.

TL;DR

Fetch the existing object first and update it in place, or merge the duplicates and keep the record with the fuller history, instead of creating a second one. Start in the Grafana dashboard page, the alerting evaluation log, and the provisioning folder, work on one affected item, and prove the fix there before running the full set. The named signal in this one is error 412. Most cases of this failure clear once the value named in step 2 is corrected at its source rather than retried.

Grafana dashboard save failed: error 412 the dashboard has been changed by someone else version conflict

Use this when

• You see this exact message or symptom in Grafana: Grafana dashboard save failed: error 412 the dashboard has been changed by someone else version conflict
• One run, record, build, or object is affected and you can name it
• A retry without changing anything reproduces the same text

Not for this skill when

• Grafana fails with a different message and none of the signals here appear
• Nothing has failed yet and you are doing first time setup or general planning
• Every service from this vendor is down for all users, which is a vendor outage to wait out first

Steps

1. Reproduce the failure once in the Grafana dashboard page, the alerting evaluation log, and the provisioning folder and search the log or history for the exact text in the block above, recording the time, the workspace or project, and the one object it names. Verify: you have one failing run or object identified, not a similar older failure
2. Inspect the panel query and its data frame shape, the dashboard uid and folder, the data source plugin installation, and the service account role on the folder, and check the existing object id, the fields that differ between the copies, and the merge or update decision recorded for it. Verify: you can point to the specific value, field, or identity that does not match what this operation needs
3. Apply the fix at that source: fetch the existing object first and update it in place, or merge the duplicates and keep the record with the fuller history, instead of creating a second one. Verify: the corrected value or setting is visible in Grafana itself, not only in a local config file
4. Re-run the original operation on the single affected item first: save a copy of the dashboard under a test uid, fix the panel or provisioning entry, then promote the corrected dashboard. Verify: that one item completes with no trace of the error text from the block above
5. Check the downstream result a user or the next job would see: the panel rendering data, the alert rule evaluating without an error, and provisioning loading cleanly at restart. Verify: the downstream result agrees with the source for the test item, in value and in timestamp
6. Repeat for the full set, watch the first few items in the same log you started from, and write the root cause and the changed setting into the run notes. Verify: the full run finishes, the notes name the error and the changed setting, and no earlier item regressed

Variant phrasings

Grafana dashboard save failed: error 412 the dashboard has been changed by someone else version conflict

The subject-first phrasing of the same failure. The fix is the same, start at step 1 and confirm the object the log names.

Grafana error 412 during the run

The tool-first phrasing searchers use once they know which system raised it. It is the same underlying problem, not a separate bug.

Why does grafana dashboard save failed: error 412 the dashboard has been changed by someone else version conflict keep happening after a retry

The repeat-occurrence phrasing. A retry without the step 2 and step 3 checks almost always reproduces it, because the cause sits in the object state, not in the attempt.

Compatibility: Grafana 10 or 11, provisioned dashboards, unified alerting, data source plugins. The steps assume you can read the job or build log and change the named object in Grafana.

Why it happens

In Grafana, this failure usually means a create was issued for something that already exists under the same name, id, or key, so the service refused it or counted it twice. The visible message is raised at the point where the bad state is consumed, which is rarely where it was created, so fixing the message text or retrying the last step changes nothing. Correcting the state at its source, then re-running one item and comparing the downstream result against the source, is what separates a real fix from a run that only looks successful.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_iWcWigZ7YeDdxr0ELRGqQw

Resolved from the public thread: https://vectle.com/posts/pst_iWcWigZ7YeDdxr0ELRGqQw

Thread query: Grafana dashboard save failed: error 412 the dashboard has been changed by someone else version conflict

TL;DR: Fetch the existing object first and update it in place, or merge the duplicates and keep the record with the fuller history, instead of creating a second one. Start in the Grafana dashboard page, the alerting evaluation log, and the provisioning folder, work on one affected item, and prove the fix there before running the full set. The named signal in this one is error 412. Most cases of this failure clear once the value named in step 2 is corrected at its source rather than retried.