How can I get the Token of OAuth?

johna1203 · October 7, 2020, 6:47pm

I am using aws cognito (OAuth) to login. I wanted to get the token that was generated when the user logs in at Reatjs, and make some request for some services at AWS. so, the question is how can I get the token using a grafana plugin?

clongeanie · October 8, 2020, 3:28pm

I’m facing the same issue than John. I’ve configured my Grafana server to allow users to connect via our identity platform (using OAuth2), and now I’d like to use the user’s access token in our datasource backend plugin. Is this token exposed somewhere?
Thanks for your help!

johna1203 · October 9, 2020, 6:10am

I’ve been reading the grafana’s code to know where it keeps the Token it takes from OAuth, and I found it but I think, it’s not saving anywhere.

here is the code where the grafana handles the Token:

github.com

grafana/grafana/blob/19caa100dc8c90fde4a145c015f88ffd82cdb6da/pkg/api/login_oauth.go#L141


		hs.handleOAuthLoginError(ctx, loginInfo, LoginError{
			HttpStatus:    http.StatusInternalServerError,
			PublicMessage: "login.OAuthLogin(NewTransportWithCode)",
			Err:           err,
		})
		return
	}
	// token.TokenType was defaulting to "bearer", which is out of spec, so we explicitly set to "Bearer"
	token.TokenType = "Bearer"

	oauthLogger.Debug("OAuthLogin Got token", "token", token)

	// set up oauth2 client
	client := connect.Client(oauthCtx, token)

	// get user info
	userInfo, err := connect.UserInfo(client, token)
	if err != nil {
		if sErr, ok := err.(*social.Error); ok {
			hs.handleOAuthLoginErrorWithRedirect(ctx, loginInfo, sErr)
		} else {

I think to do what we want I think we need to use this:
“Enable token authentication” https://grafana.com/docs/grafana/latest/developers/plugins/add-authentication-for-data-source-plugins/#enable-token-authentication

maybe, we have to prepare an OAuth server that supports “OAuth 2.0 Client Credentials Grant”. and authenticate the puglin request. I’m still investigating about that.

https://oauth.net/2/grant-types/client-credentials/#:~:text=The%20Client%20Credentials%20grant%20type,to%20access%20a%20user’s%20resources.

johna1203 · October 9, 2020, 5:09pm

Using the “Enable token authentication” I wrote before I was able to authenticate my request. but I have no way of identifying which user is logged in.
I am asking another question here Is there any way to pass a Global variables on a route?
If I can find a solution for topic above, I think this topic will be solved as well.

matt8992 · April 9, 2023, 12:24am

I am trying to do something similar –
I have grafana configured to use my Fief OAuth2 identity provider, but while it logs in just fine, it seems to be loosing the accessToken that I would want to hit the backend JSON API for that user’s data.