POSTMAN TEST: Stuck at Grafana Loading

[raj793]

Testing via POSTMAN I'm using an AWS Cognito access token with Grafana user created with it's username.

ERROR:

http: panic serving x.x.219.x:60530: interface conversion: interface {} is nil, not string
goroutine 21 [running]:
net/http.(*conn).serve.func1(0xc0000701e0)
/usr/local/go/src/net/http/server.go:1769 +0x139
panic(0x7fa4a0, 0xc0000633b0)
/usr/local/go/src/runtime/panic.go:522 +0x1b5
github.com/caido/grafana-auth-proxy/pkg/validation.(*TokenValidator).Validate(0xc000511440, 0xc0001dee0f, 0x60b, 0x60b, 0x0, 0x0)
/build/pkg/validation/validation.go:55 +0x6b9
main.(*RequestsHandler).ServeHTTP(0xc000458420, 0x8f9860, 0xc000166000, 0xc0000b4000)
/build/proxy.go:42 +0xa1
net/http.serverHandler.ServeHTTP(0xc00006a9c0, 0x8f9860, 0xc000166000, 0xc0000b4000)
/usr/local/go/src/net/http/server.go:2774 +0xa8
net/http.(*conn).serve(0xc0000701e0, 0x8fa1a0, 0xc000510000)
/usr/local/go/src/net/http/server.go:1878 +0x851
created by net/http.(*Server).Serve
/usr/local/go/src/net/http/server.go:2884 +0x2f4
CONFIG:

2021/03/09 09:02:08 Unable to load a .env file
2021/03/09 09:02:08 JWT Cookie name : MyAccessToken
2021/03/09 09:02:09 JWT accepted algorithms : [RS256]
2021/03/09 09:02:09 JWT accepted audience : clientId
2021/03/09 09:02:09 JWT accepted issuer : https://cognito-idp.region.amazonaws.com/id
2021/03/09 09:02:09 JWT Grafana authentication claim : username
2021/03/09 09:02:09 Proxy serving : http://localhost:3000
2021/03/09 09:02:09 Proxy running on port : 5000

COOKIE:

MyAccessToken="token" Path=/; Domain=some.amazonaws.com; Expires=Fri, 11 Mar 2022 10:49:10 GMT;

I'm new to Go and I'm not sure what that error message means. What am I doing wrong?

[raj793]

I got it working but my postman response is stuck at Grafana loading animation

[Sytten]

It has been a while since I touched this code, but checking the error it seems to have no env. Did you make sure to provide the necessary config?
I will try to debug it further if I got the time.

Can you send me a token at code [@] efugulin.com so I have a way to reproduce it? Thanks

[Sytten]

From the error, it seems your tokens don't have an aud claim.
I should probably make sure the think is not nil before casting it though so I will fix that.
https://github.com/caido/grafana-auth-proxy/blob/master/pkg/validation/validation.go#L55

[Sytten]

It does seem like the access token of cognito doesn't have an audience, so I will make that parameter optional.
https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-with-identity-providers.html#user-pool-access-token-payload

[raj793]

@Sytten It's working, I was sending access_token instead of id_token - which has the AUD.

[raj793]

I am getting the Authenticated 200 OK loading page of Grafana but it doesn't go any further than that, is that because of POSTMAN? It should work on a web page?

[Sytten]

Most likely because of postman yes.

[raj793]

ok I will try embedding and testing it.

[Sytten]

I made a quick PoC with optional aud if you want to use the access token. Still need some tests before it can be merged, but should work.
https://github.com/caido/grafana-auth-proxy/tree/emile/optional-aud

[raj793]

@Sytten Thanks for creating the one with Aud but the id token way works well for me. I had another question as to how are you setting the cross domain iframe cookie? Or are you getting around this by keeping the domain same?

[Sytten]

What we did was put grafana on a different subdomain (grafana.mydomain.com) but the main api (api.mydomain.com) was setting the cookie for the whole domain (.mydomain.com) so it was sent properly to all subdomains.
You can also do path based routing and rewrite the path on your load balancer/reverse proxy or you can ask grafana to add a prefix to the paths.