[Feature Request] Service account auth for Grafana widget

[davepgreene]

Description

The Grafana widget only allows you to authenticate via basic auth (i.e. a username/password). It would be really nice if you could update the widget to also support service accounts that authenticate by sending the service account's token as a Bearer token rather than basic auth.

The change should be simple. It would involve updating the grafana widget proxy handler to use the credentialedProxyHandler and add a conditional in this block that checks for the presence of a key in the widget object and sets the Authorization header to Bearer <key>. In the event that a username and password are provided it could fall back to using the base64 encoded Basic auth that's provided from the genericProxyHandler.

Other

No response

[llaumgui]

Good idéal. My Grafana widget does't work since my LDAP migration. Service account is more secure.

[jackrh]

I took a stab at this, since it looked simple, and with the detailed instructions provided by @davepgreene above it certainly was.
main...jackrh:homepage:main

I would submit a PR but the issue is most of the data the widget uses is from /api/admin/stats , which I discovered doesn't support tokens -

The Admin HTTP API does not currently work with an API Token. API Tokens are currently only linked to an organization and an organization role. They cannot be given the permission of server admin, only users can be given that permission. So in order to use these API calls you will have to use Basic Auth and the Grafana user must have the Grafana Admin permission. (The default admin user is called admin and has permission to use this API.)
https://grafana.com/docs/grafana/latest/developers/http_api/admin/#admin-api

Until Grafana adds a token with the ability to have server wide permissions, I don't see a way of getting this to work as is.