Support custom OAuth response for datasource plugin

patrickju · April 26, 2019, 9:42am

I’m building a datasource plugin and use routes in my plugin.json to define the API endpoint with a tokenAuth section describing OAuth authentication.

This is not working because Grafana expects the answer for an authentication to for example list the refresh token as “refresh_token” whereas my endpoint returns “refreshToken”. What can I do?

daniellee · April 26, 2019, 4:51pm

That sounds non-standard - what are you using for your OAuth and why is it returning refreshToken?

patrickju · April 26, 2019, 6:44pm

I agree, it’s non-standard. Unfortunately I have no influence over it, it’s a proprietary API. That’s why we can’t have nice things, I guess. Or can I?

daniellee · April 30, 2019, 8:58am

We don’t have a way to configure the names of the oauth fields.

It is possible to do it another way but it will be a lot of extra work. We recently added a new hook to Grafana that allows you to have a backend component (written in Go) in your datasource. You can authenticate however you want on the backend - so you could copy the relevant Go code from Grafana into your backend component and tweak it.

Docs: https://grafana.com/docs/plugins/developing/backend-plugins-guide/

I don’t really have a good example of custom auth. I know some custom plugins have done it.

In the sample datasource: https://github.com/grafana/simple-json-backend-datasource/blob/master/pkg/datasource.go#L132

You would do it in the MakeHttpRequest function.

The Stackdriver datasource sort of does some custom auth:

github.com

grafana/grafana/blob/master/pkg/tsdb/stackdriver/stackdriver.go#L599


	for _, route := range plugin.Routes {
		if route.Path == "stackdriver" {
			stackdriverRoute = route
			break
		}
	}


	projectName := dsInfo.JsonData.Get("defaultProject").MustString()
	proxyPass := fmt.Sprintf("stackdriver%s", "v3/projects/"+projectName+"/timeSeries")


	pluginproxy.ApplyRoute(ctx, req, proxyPass, stackdriverRoute, dsInfo)


	return req, nil
}


func (e *StackdriverExecutor) getDefaultProject(ctx context.Context) (string, error) {
	authenticationType := e.dsInfo.JsonData.Get("authenticationType").MustString(jwtAuthentication)
	if authenticationType == gceAuthentication {
		defaultCredentials, err := google.FindDefaultCredentials(ctx, "https://www.googleapis.com/auth/monitoring.read")
		if err != nil {
			return "", fmt.Errorf("Failed to retrieve default project from GCE metadata server. error: %v", err)

And this is the code in Grafana that does auth for plugin routes and handles refresh tokens (and which Stackdriver calls manually):

github.com

grafana/grafana/blob/master/pkg/api/pluginproxy/ds_auth_provider.go#L19-L82


func ApplyRoute(ctx context.Context, req *http.Request, proxyPath string, route *plugins.AppPluginRoute, ds *m.DataSource) {
	proxyPath = strings.TrimPrefix(proxyPath, route.Path)


	data := templateData{
		JsonData:       ds.JsonData.Interface().(map[string]interface{}),
		SecureJsonData: ds.SecureJsonData.Decrypt(),
	}


	interpolatedURL, err := interpolateString(route.Url, data)
	if err != nil {
		logger.Error("Error interpolating proxy url", "error", err)
		return
	}


	routeURL, err := url.Parse(interpolatedURL)
	if err != nil {
		logger.Error("Error parsing plugin route url", "error", err)
		return
	}

This file has been truncated. show original

We use a library for oauth which expects refresh_token so one way to do it would be to provide your own access token implementation and translate refreshToken to refresh_token:

github.com

grafana/grafana/blob/master/pkg/api/pluginproxy/access_token_provider.go#L75-L82


	params := make(url.Values)
	for key, value := range provider.route.TokenAuth.Params {
		interpolatedParam, err := interpolateString(value, data)
		if err != nil {
			return "", err
		}
		params.Add(key, interpolatedParam)
	}

Hope that helps.

patrickju · April 30, 2019, 9:32am

Okay, that makes sense. Then we’ll probably take this route. Thanks a lot for your help.

Topic		Replies	Views
Best practice for managing custom token authentication Grafana Plugin Development plugins , auth	0	186	January 21, 2024
Refreshing OAuth Token Hourly for JSON API Data Source Configuration api , auth , oauth , datasource , json-api-datasource	3	880	July 10, 2023
Issue with authenticating custom data source plugins Grafana Plugin Development auth	2	1269	June 28, 2022
Datasource Plugin and Oauth2 route Grafana Plugin Development oauth , datasource	3	1048	September 20, 2022
REST API call with SSO auth in Grafana datasource plugin Grafana Plugin Development	1	631	August 4, 2023

Support custom OAuth response for datasource plugin

Related topics