0

I am attempting to use github oauth with Grafana. The error in the grafana logs is

msg=login.OAuthLogin(NewTransportWithCode) logger=context userId=0 orgId=0 uname= error="oauth2: server response missing access_token"

I executed the following command inside of the grafana container to insure I'm getting a valid response from github:

curl --request POST \
  --url 'https://github.com/login/oauth/access_token' \
  --header 'content-type: application/json' \
  --data '{"grant_type":"authorization_code","client_id": "CLIENT_ID","client_secret": "CLIENT_SECRECT","code": "6ccfdded0ffe5518bc56","redirect_uri": "https://grafana.mydomain.com/login/github"}'

The response looks like what I would expect access_token=8f8a62bbd616f4545f97a1d4cd9931abf56f4245&scope=user%3Aemail&token_type=bearergrafana

Grafana Settings

"GF_AUTH_GITHUB_ENABLED=True",
"GF_LOG_LEVEL=debug",
"GF_AUTH_GITHUB_AUTH_URL=https://github.com/login/oauth/authorize",
"GF_SERVER_DOMAIN=mydomain.com",
"GF_AUTH_GITHUB_ALLOW_SIGN_UP=False",
"GF_SERVER_ROOT_URL=https://grafana.mydomain.com",
"GF_SERVER_ROUTER_LOGGING=True",
"GF_SECURITY_LOGIN_REMEMBER_DAYS=7",
"GF_SECURITY_SECRECT_KEY=MY_SECRECT",
"GF_SECURITY_ADMIN_USER=admin",
"GF_SECURITY_ADMIN_PASSWORD=password",
"GF_AUTH_GITHUB_SCOPES=user:email",
"GF_AUTH_GITHUB_TOKEN_URL=https://github.com/login/oauth/access_token",
"GF_AUTH_GITHUB_CLIENT_ID=CLIENT_ID",
"GF_AUTH_GITHUB_API_URL=https://api.github.com/user",
"GF_AUTH_GITHUB_CLIENT_SECRECT=CLIENT_SECRECT",
"PATH=/usr/share/grafana/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
"GF_PATHS_CONFIG=/etc/grafana/grafana.ini",
"GF_PATHS_DATA=/var/lib/grafana",
"GF_PATHS_HOME=/usr/share/grafana",
"GF_PATHS_LOGS=/var/log/grafana",
"GF_PATHS_PLUGINS=/var/lib/grafana/plugins",
"GF_PATHS_PROVISIONING=/etc/grafana/provisioning"

HAProxy Config

defaults
  log     global
  mode    http
  option  httplog
  option  dontlognull
  timeout connect 10000
  timeout client  180000
  timeout server  180000
  errorfile 400 /etc/haproxy/errors/400.http
  errorfile 502 /etc/haproxy/errors/502.http
  errorfile 503 /etc/haproxy/errors/503.http
  errorfile 504 /etc/haproxy/errors/504.http

frontend ft_http
  bind 0.0.0.0:80
  bind 0.0.0.0:443 ssl crt /etc/ssl/cert.pem crt /etc/ssl/cert2.pem
  redirect scheme https if !{ ssl_fc }
  mode http
  option http-server-close
  option forwardfor
  acl host_grafana hdr(host) -i grafana.mydomain.com
  use_backend bk_grafana if host_grafana
  default_backend no_match

backend bk_grafana
  mode http
  option forwardfor
  option httpchk HEAD / HTTP/1.1\r\nHost:localhost
  server grafana 172.31.28.99:3000 check
  http-request set-header X-Forwarded-Port %[dst_port]
  http-request add-header X-Forwarded-Proto https if { ssl_fc }

backend no_match
  http-request deny deny_status 400

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.