OAuth authentication

[yesoreyeram]

I am planning to implement OAuth2 authentication support in upcoming version of the plugin. I am looking for inputs.

• What kind of OAuth workflow you are using?
• Any specific api you are interested? And any reference documentation you suggest?
• Can you contribute in testing/developing the feature?

[DominHa]

I'd like to use this with the latest Google Analytics data API (google.analytics.data.v1beta.) as it doesn't support API keys!

Is this available for the Grafana Cloud Infinity plugin as well? :)

[emyes]

@yesoreyeram Thanks a lot for the quick assistance. Appreciated !

[emyes]

@yesoreyeram Do we have datasource.yaml file with oauth configuration somewhere for the reference ? I'm able to find one from below path https://github.com/yesoreyeram/grafana-infinity-datasource/tree/main/try/provisioning/datasources but it doesn't have oauth informations.

[yesoreyeram]

not yet. Will update the documents later. Main objective of this release is to make sure thing works correctly. But still, you can get the corresponding properties and structure from https://github.com/yesoreyeram/grafana-infinity-datasource/blob/main/src/types.ts#L20

[emyes]

Thanks for the feedback @yesoreyeram Managed to get the information from repo source code already. Appreciated!

[wdma]

I am not yet using it, but I would like to be able to use U.S. Government open data sets (https://developers.login.gov/oidc/). I am new to Grafana and the Infinity Datasource plugin, but would be happy to do testing and eventually become a contributer.

[teturou8001]

Would you also have a plan to support X.509 client certificate authentication (https://datatracker.ietf.org/doc/html/rfc8705)?

[yesoreyeram]

Have you tried the TLS settings?

[siva1024]

I have tried it but i am getting the error saying "error getting response from URL"

[hamzeh1995]

Hi,
I have an API which requires OAuth 2 that expires every 4 hours, how can I address this issue using infinity (generate new token every 4 hours automatically).
Thanks.

[manjunathnayaka22]

Thank you for the details but WebEx Oauth2 is seems to be different and unable to send over header.

[Bharadwaj1990]

thank you @jullienl the document provided above is useful and we are trying to do the same but we are unable to generate token.

1. In Variables section, we don't see anything under "Preview of values".
2. In Dashboard we get "error getting data frame. 401".
   Could you please help us on this

[jullienl]

401 is an unauthorized error code, so you need to check your credentials or you're not using the correct authorization header field.

[luismy]

Hi guys!

I've successfully used this approach with a different API (thanks @yosiasz & @jullienl). As a PoC does the trick, but from a security point of view it, I won't be able to use this approach as anybody with view only access to the dashboard will be able to get the credentials and start generating auth tokens outside of Grafana.

@yesoreyeram, are you planning to support this specific use case? From a security point of view, it would be nice if the plugin let you to configure a POST login API call where the token generated is added to any queries to the datasource using a configurable header, or maybe made the token available as an internal variable so users can add them as header value or query param?

Obviously I'm talking without any knowledge related to the implementation of your plugin.

[aheilmaier]

@jullienl thank's a lot. With your trick my equinix api query is working now.
@yesoreyeram is the oauth2 feature broken in grafana (cloud) or is the workflow to get a bearer token not implemented in the plugin ?

I was trying the oauth2 with the infinity plugin 2.6.2 in grafana cloud but was not able to get oauth2 working.
Equinix api looks very straigt forward, but with the oauth2 I always received error 401 unauthorized.

https://developer.equinix.com/catalog/accesstokenv1#operation/GetOAuth2AccessToken

[thanissi]

Hi @yesoreyeram

I'm trying to configure a data source endpoint with one of our custom API endpoints using Azure OAuth2 Client Credential. Can you confirm this is supported and do you have a working example? Data source config looks straight forward but getting 401. Looking at Grafana query inspector i didn't see Authorization header with "Bearer + Token" that I would expect.

curl -X 'GET' -H 'Content-Type: application/json' 'https://xxxxxxxxxxx'

[thanissi]

When i tried making a query inside a dashboard / panel, does the plugin add token to the header "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbG...." ?

[yesoreyeram]

I added #404 for detailed instruction on how to setup azure authentication. Hope it helps

[dylan-asos]

Discussion id 404 404's

I just came here to say that.

[yesoreyeram]

Oopsy .. I just broke it.. sorry Dylan. If you can change yesoreyeram part of the url to grafana it should work.

[yesoreyeram]

it should be back now.

[manjunathnayaka22]

@yesoreyeram
I am trying to pull the data of WebEx using Oauth2 parameter in Infinity plugin, but getting 500 error while accessing the data from one of the API link of WebEx.
If I use only Bearer token it works fine, but this Beater token will get expiry after 12 hours, hence I need to use Oauth2 method.

Could you please suggest me if I need to add any additional parameter in this Plugin.

Error:
Query error
{"status":500,"statusText":"Internal Server Error","data":{"message":"Metric request error"},"config":{"url":"api/ds/query","method":"POST","data":{"queries":[{"refId":"A","key":"Q-ede4ce7c-307b-495f-acde-bc75c8485a30-0","type":"json","source":"url","format":"table","url":"https://test.com/v1/hybrid/connectors","url_options":{"method":"GET","data":""},"root_selector":"","columns":[],"filters":[],"global_query_id":"","datasourceId":23,"intervalMs":2000,"maxDataPoints":2339}],"range":{"from":"2022-07-29T09:17:13.488Z","to":"2022-07-29T10:17:13.488Z","raw":{"from":"now-1h","to":"now"}},"from":"1659086233488","to":"1659089833488"},"requestId":"explore_left","retry":0,"headers":{"X-Grafana-Org-Id":3},"hideFromInspector":false},"message":"Metric request error"}

[yosiasz]

the principle is api agnostic. I am not using WebEx. What is the endpoint to get a token? create a plugin and add that endpoint to that variable. every time the dashboard in question loads you get a new token

[manjunathnayaka22]

In WebEx Bearer token get expiry every 12 hours, so except Oauth2 I dont think so we have any other option in getting data through API. @yesoreyeram @yosiasz
Please suggest me further by reviewing the above said error.

[solly4by7]

Hi @manjunathnayaka22 were you able to use Oauth2 successfully. Can you let me know the steps that you followed. I keep getting errors.

[luismy]

@manjunathnayaka22, @yosiasz & @yesoreyeram bear in mind that the approach of using a variable to generate the token and then use it in the dashboard has a massive security flaw as anybody with read-only access will be able to get the original credentials that allow you to generate the auth token :(

[yosiasz]

Indeed. It is anti pattern

[manjunathnayaka22]

@yesoreyeram
Here is the additional details of WebEx access token. Could you please confirm whether Infinity plugin support for WebEx API or not
https://developer.webex.com/docs/integrations

[yesoreyeram]

Infinity plugin currently only supports client_credentials/jwt_token oauth2 grant_types. It looks like webex doesn't support neither of them. Webex seems only supporting authorization_code /refresh_token.

I am neither familar with webex APIs nor have access to it. So correct me If I am wrong. If it supports client_credentials and not working with infinity, let me know. I can investigate further.

As you see in the infinity config, it supports only these.

If you can, send us a pull request to implement other oauth types. happy to merge. ( also any PR to docs also welcome if you see them misleading )

[manjunathnayaka22]

@yesoreyeram Thank you for your response on this query.
Currently Infinity support Bearer Token method without any issue, but this token get expire after 12 hours in WebEx. Additionally WebEx support Oauth2 method to integrate with 3rd party application. Please go through this link and let me know if you could help me anything further to this.
https://developer.webex.com/docs/integrations#requesting-permission

Thanks

[yesoreyeram]

Unfortunately the above link you shared require interactive authentication like popup and agree... Unfortunately we can't have them in grafana for various reasons. I can't think of any other solution.
If you find any solution feel free to send pull request.

[yesoreyeram]

Also i don't have enough time to investigate now.

[gavinwoolley]

I've been trying to use the OAuth2 Auth Type to get an azure token, so can authenticate to the azure billing API.
Can't seem to get it working. the query explorer throws 500s for everything.
Do you have an example how to get an Azure token?
and maybe even an example of getting Cost management query https://docs.microsoft.com/en-us/rest/api/cost-management/query/usage?tabs=HTTP

thanks

[yesoreyeram]

Azure client credentials should work and tested. Instead of scope, try adding those as endpoint params.

[gavinwoolley]

@yesoreyeram thanks for your reply, im not sure what you mean?
i have this in DS - I tried adding these endpoint params today and same outcome with or without them

and every time i test any query, it throws this

[yesoreyeram]

I added #404 for detailed instruction on how to setup azure authentication. Hope it helps

[berend-attendi]

Hi, thank you for your instruction. With the exception of the scopes, the instruction works for me. The scope is mandatory so I can't leave it empty. If I fill in https://management.azure.com/.default then it works.

When I want to connect to the cost management API for aggregated costs, I get a 503 error. When I test with Postman with grant type Authorization code, it works. But this grant type is not possible with infinity. Do you know how I can get this to work? It concerns the following request: GET https://management.azure.com/providers/Microsoft.Management/managementGroups/{managementGroupId}/providers/Microsoft.Billing/billingPeriods/{billingPeriodName}/providers/Microsoft.Consumption/aggregatedCost? api-version=2021-10-01

Thanks

[343101]

@yesoreyeram - Is this limited to Azure authentication? We have a different token endpoint and the resource endpoint is different.
The flow is (a typical client cred flow)

1. hit the token url to get the token.
2. Pass the token to the another endpoint to get the data.
   Will this flow work with infinity plugin.

[manjunathnayaka22]

Thanks @gavinwoolley, even I am getting same error, did you get a chance to fix this issue?

[gavinwoolley]

Nope, can't get it to work. No matter what I put in the oAuth section of data source. It blows up with 500 errors .

[Xore]

any answer to it ?

Got the same issue like you.

No matter what I enter in oauth2 I get a 500 error.

If I change it to "no auth" I get a correctly "not authorized" message.

[yesoreyeram]

Whats the API you are using? Steps to reproduce? What type of OAuth the API supported? Any other details appreciated

[Xore]

API: https://developer.sophos.com/apis
Token Endpoint: https://id.sophos.com/api/v2/oauth2/token
Testing Endpoint: https://api.central.sophos.com/whoami/v1
Type: OAuth2 with JWT

Steps to reproduce:

1. Create a new Infinity Data Source
2. Change Auth Type to OAuth2
3. use Client Credentials - no Endpoint params
4. Save & Test
5. Explore
6. Query on Testing Endpoint

what it should do:
response with
{ "id": "57ca9a6b-885f-4e36-95ec-290548c26059", "idType": "tenant", "apiHosts": { "global": "https://api.central.sophos.com", "dataRegion": "https://api-us03.central.sophos.com" } }

what it does:
Internal Server Error 500

As soon as I set "Auth Type" to OAuth2 I get this error, even with the Endpoint "https://jsonplaceholder.typicode.com/users"

[mikegorman-nf]

I wrote up a Bug, as there is a panic involved, and before I noticed this conversation. My issue is with an AWS Cognito source, and the plugin is causing a panic, per the Grafana debug logs. As noted in the bug, the actual API works fine if I grab and put in a Bearer token rather than OAuth2, so it appears to be in the process of receiving the token via the OAuth process.
#384

[Barteck197]

Hello everyone!
I have the following OAuth flow:

1. Send authentication request with Authorization: Basic: xxxxxx header
2. Receive authentcation response with Token: [api-token] in response header.
3. Then I use the [api-token] in each request for the data.

[api-token] needs to be refreshed every 15 minutes.

As far as I managed to work this out the plugin currently not supports this kind of flow. Or has anyone managed to extract the token from response header?

[Barteck197]

I tried the @yosiasz solution of setting the variable in the dashboard but it produced a bug in the plugin (i guess), describing it here: #432

[ZadeFrontier]

Any user would be able to see the dashboard variables for token generation and get the client secret if it's configured at the dashboard level. This poses a really huge security risk.

[mikegorman-nf]

If it is a carefully permissioned token, not as much. If the token will only allow the user to see the same data they can see via Grafana, then the information risk has increased. It has to be done carefully, of course, and there is an opportunity to easily provide too many permissions, so it is not the best solution, but an acceptable one with proper procedures.

[solly4by7]

While I am able to have successful result in Postman it results in 0 series in Grafana - Infinity Datasource. Any help on why is this coming? @yesoreyeram

[exydos212]

i have a problem configuring garafana with ninjaone data, i followed this procedure but i got an error message

health check failed with url https://eu.ninjarmm.com. error received: error getting response from url https://eu.ninjarmm.com. no response received. Error: Get "https://eu.ninjarmm.com": oauth2: "invalid_client"

Guide to Configuring Grafana with ninjaOne.pdf

@yesoreyeram : could you please assist ?

[ghost]

I want to query API endpoints that require SSL certificates. I have a .p12 file and a import password provided by the data provider, which is associated with the user's email. Does infinity plugin support this type of authentication? I see in the data provider's tutorial that they use SOAP UI and set "KeyStore" (path to the .p12 file) and "KeyStore Password" under SSL settings. I would appreciate some insights!

[Jack-GH2000]

Is there a plan to implement the "Authorization Code" to the grant types at a later date? I need it in order for it to work with some of the endpoints on the NinjaOne API.

[yesoreyeram]

No plans.

[breuken]

Are there plans to support:

• Federated credentials in azure instead of client secret?
• Using the managed identity of the infrastructure running the grafana instance (e.q. VM, container app, managed grafana in Azure)?

[zoltanbedi]

nope.

[raviagupta-tech]

Hi, I am looking for some help on setting "OAuth 2.0 client credentials" using the helm chart. I am using GrafanaDatasource of a type yesoreyeram-infinity-datasource and passing clientid, tokenurl in various ways but none of them are working. can anyone share if they have implemented this?