Generic Oauth: OAuth2 Authorization code was already redeemed

Grafana Configuration
,
1

I am implementing the generic oauth for grafana.
My grafana is running behind load balancer and nginx.
I am getting error as “Failed to authenticate request” client=auth.client.generic_oauth error=“[auth.oauth.token.exchange] failed to exchange code to token: oauth2: "invalid_grant" "AADSTS54005: OAuth2 Authorization code was already redeemed, please retry with a new valid code or use an existing refresh token.”

I can see the login.microsoft url is called twice.

first time with valid details, second time with valid details and i cansee SSO_reload = true.

I am using Grafana v12.0.0 (4c0e7045f9)

I am using amazon linux 2023 box

2

I’m sorry to hear that you’re experiencing difficulties.

Grafana can provide valuable information about certain issues through its own debug logs. These logs can help troubleshoot and identify the root cause of problems (especially if they are related to anything that can be configured via Grafana config file).

To enable debug logging edit the configuration file grafana.ini:

[log]
# Either "console", "file", "syslog". Default is console and file
# Use space to separate multiple modes, e.g. "console file"
mode = console file

# Either "debug", "info", "warn", "error", "critical", default is "info"
level = debug

Then restart grafana for the setting to go into effect.

Replicate the problem and check Grafana logs. However, before posting the debug logs on the community forum, it is important to sanitize any private details such as passwords, tokens, IPs, names, … By including properly formatted debug logs (with sanitized information) and details about your installations (e.g. exact Grafana version, how it was installed, OS details, …), you greatly enhance the chances of receiving accurate assistance and solutions.

3

Hi @jangaraj ,

Thanks for your reply. Please find the complete configuration .

I have installed grafana 12 version in a EC2 box with load balancer in front. I have Nginx configured as reverse proxy.

After enabling the Debug logs, i am getting “Failed to authenticate request” client=auth.client.generic_oauth error=“[auth.oauth.token.exchange] failed to exchange code to token: oauth2: “invalid_grant” "AADSTS54005: OAuth2 Authorization code was already redeemed, please retry with a new valid code or use an existing refresh token.”

I have analysed the network calls, login.microsoft.com/{with all our client secret, tenant id, redirect URL } is called twice.

first call has the URL with all the details and the second call has the URL ending with &sso_reload=true.
I feel the URL is called twice, which tries to use the TOKEN twice.. which results in the above error.

I am not able to stop the second API call.

Kindly let me know for further information

4

Hi guys,
I have the same issue.

Is there any solution or suggestions?

Thank you in advance.