"token pass through" feature for JWT Authentication

[TBOU]

What would you like to be added:

A new JWT authentication mode has been added recently (cf. [Feature request] JWT Authentication #8198).

For this new authentication mode, would it be possible to have the same "token pass through" feature for data source plugins as the one already available with OAuth authentication?

More details below on the current mechanism for OAuth authentication.

When using OAuth authentication, it is possible to forward the OAuth access token to a data source plugin. This allows the data source plugin to send requests with an "Authorization" header containing the same credentials as the ones with which the user logged into Grafana (useful when querying a database with ACLs, because the Grafana user identity can be transmitted to the database and the results are filtered by user's ACLs).

This feature is activated by setting the "oauthPassThru" key to true in the JSON data of the data source configuration.

For OAuth authentication, it is implemented in 2 places.

For data source "client-side" plugins (through the Grafana data source proxy), in ds_proxy.go :

if oauthtoken.IsOAuthPassThruEnabled(proxy.ds) {
	if token := oauthtoken.@(proxy.ctx.Req.Context(), proxy.ctx.SignedInUser); token != nil {
		req.Header.Set("Authorization", fmt.Sprintf("%s %s", token.Type(), token.AccessToken))
	}
}

For data source "backend" plugins, in datasource_plugin_wrapper_v2.go :

if oauthtoken.IsOAuthPassThruEnabled(ds) {
	if token := oauthtoken.GetCurrentOAuthToken(ctx, query.User); token != nil {
		delete(query.Headers, "Authorization")
		query.Headers["Authorization"] = fmt.Sprintf("%s %s", token.Type(), token.AccessToken)
	}
}

Why is this needed:

Because it allows transmitting Grafana user identity to requests made by data source plugins, which is useful when querying databases with ACLs.

Also because this feature is already present with OAuth authentication.

@sakjur suggested to see first if #17846 could be a response but it seems that not. In #17846, headers' values must be set statically in the data source configuration.
The "token pass through" feature is dynamic : the token to pass to the "Authorization" header is the one gotten by the user that logged into Grafana (it is unknown at data source configuration time).

[akevdmeer]

We would really like JWT passthrough. I tried that linked PR on top of Grafana 10.4.2 and it works. (What I did spot is that it forwards the access token also as X-Id-Token which I think is inappropriate.)

[akevdmeer]

@yuesenxiong I've asked on the Grafana slack what it would take to move this forward, and received the feedback that your PR is not against the grafana/grafana repo so that it can't be assigned for review.

Could you please create a pull request against this repo?