I want to enable JWT token in grafana ,so that i don't want to give send username and password to client..When i am trying this it is showing failed to start

mmillies · August 11, 2023, 3:01pm

Hi,

This seems to happen to me when grafana didn’t recognize my passed in JWT as a JWT. More specifically, if you happened to specify the incoming header as Authorization as opposed to some other custom header for passing your JWT and it doesn’t recognize the token as a JWT one.

One silent error that really messed with me for a while was that the JWT implementation appears to require the claim sub to exist on your token. But the message alerting you to it appears to never be reached/logged as a result of a guard in the code.

issue with sub property requirement silently failing JWT processing:

request stopped here:

github.com

grafana/grafana/blob/a9d2bbc814bf9f8e3d9a69660fce8f18c7d259b8/pkg/services/authn/authnimpl/service.go#L194


      
          	// postLoginHooks are called after a login request is performed, both for failing and successful requests.
          	postLoginHooks *queue[authn.PostLoginHookFn]
          }
          
          func (s *Service) Authenticate(ctx context.Context, r *authn.Request) (*authn.Identity, error) {
          	ctx, span := s.tracer.Start(ctx, "authn.Authenticate")
          	defer span.End()
          
          	var authErr error
          	for _, item := range s.clientQueue.items {
          		if item.v.Test(ctx, r) {
          			identity, err := s.authenticate(ctx, item.v, r)
          			if err != nil {
          				// Note: special case for token rotation
          				// We don't want to fallthrough in this case
          				if errors.Is(err, authn.ErrTokenNeedsRotation) {
          					return nil, err
          				}
          
          				authErr = errors.Join(authErr, err)
          				// try next

guard existing JWT processing due to missing sub:

github.com

grafana/grafana/blob/a9d2bbc814bf9f8e3d9a69660fce8f18c7d259b8/pkg/services/authn/clients/jwt.go#L160


      
          		return false
          	}
          
          	jwtToken := s.retrieveToken(r.HTTPRequest)
          
          	if jwtToken == "" {
          		return false
          	}
          
          	// If the "sub" claim is missing or empty then pass the control to the next handler
          	if !authJWT.HasSubClaim(jwtToken) {
          		return false
          	}
          
          	return true
          }
          
          func (s *JWT) Priority() uint {
          	return 20
          }

the message I would have liked to have received to save me time and effort troubleshooting. (but the execution path never makes it here given the above code references.

/pkg/services/authn/clients/jwt.go#L64

If your token has a sub claim in it, and you’re not using the Authentication header, and you still have this issue. I’ll need more info about your grafana.ini [auth.jwt] section, I’m just tossing guesses out based on my own experience trying to integrate via the JWT plugin. Be sure to sanitize any identifying/sensitive details in the section before you post anything.

best of luck.

Topic		Replies	Views
JWT Grafana auth token - 'No keys found' Authentication query-help , auth , jwt	1	1940	August 28, 2022
JWT Authentication Error in Grafana Authentication configuration , oauth , jwt	2	2093	September 6, 2022
JWT Authentication issue in Grafana Configuration configuration , oauth	11	7948	June 20, 2022
Authenticate via auth jwt Authentication jwt	0	299	December 21, 2023
How to enable JWT Authentication for Grafana v8.5.22 Authentication	2	1874	January 4, 2024

I want to enable JWT token in grafana ,so that i don't want to give send username and password to client..When i am trying this it is showing failed to start

Related topics