HTTP 401 Unauthorized #26

miguelemosreverte · 2020-07-27T16:07:58Z

the bug

grr apply mydash.libsonnet 
Folder not found and/or configured. Applying to "General" folder.
2020/07/27 12:17:01 Error retrieving dashboard my-dash.json: 401 Unauthorized

The text was updated successfully, but these errors were encountered:

miguelemosreverte · 2020-07-27T16:08:59Z

the explanation

Per the documentation, Grafana explicitely shows how the call protocol should include the Authentication headers, look!

Calling without headers, like Grizzly does as of now:

curl http://api_key:eyJrIjoielBIZ1BYdWJVRWVQQ2dKYkM4S0ZQcmtDd3NSa2hCZFQiLCJuIjoiYXBpX2tleSIsImlkIjoxfQ==@localhost:3000/api/org
{"message":"Basic auth failed"}

Calling with headers:

curl http://api_key:eyJrIjoiT0tTcG1pUlY2RnVKZTFVaDFeyJrIjoielBIZ1BYdWJVRWVQQ2dKYkM4S0ZQcmtDd3NSa2hCZFQiLCJuIjoiYXBpX2tleSIsImlkIjoxfQ==@localhost:3000/api/org  -H "Authorization: Bearer eyJrIjoidnBBaXhUdVQyS0VaWlJ4bGR6YWF4M3h4U3RTdllQem4iLCJuIjoiYXBpX2tleSIsImlkIjoxfQ=="
{"id":1,"name":"Main Org.","address":{"address1":"","address2":"","city":"","zipCode":"","state":"","country":""}}

miguelemosreverte · 2020-07-27T16:16:14Z

the solution

By setting the Authorization header for all requests to Grafana, now I can hit Grafana successfully.

trotttrotttrott · 2020-07-27T17:08:14Z

It shouldn't make a difference. In the docs right below where your screen shot cuts off, it states:

The API Token can also be passed as a Basic authorization password with the special username api_key...

Furthermore, it looks like your API key may be copied incorrectly in your examples.

curl http://api_key:eyJrIjoielBIZ1BYdWJVRWVQQ2dKYkM4S0ZQcmtDd3NSa2hCZFQiLCJuIjoiYXBpX2tleSIsImlkIjoxfQ==@localhost:3000/api/org

curl http://api_key:eyJrIjoiT0tTcG1pUlY2RnVKZTFVaDFeyJrIjoielBIZ1BYdWJVRWVQQ2dKYkM4S0ZQcmtDd3NSa2hCZFQiLCJuIjoiYXBpX2tleSIsImlkIjoxfQ==@localhost:3000/api/org  -H "Authorization: Bearer eyJrIjoidnBBaXhUdVQyS0VaWlJ4bGR6YWF4M3h4U3RTdllQem4iLCJuIjoiYXBpX2tleSIsImlkIjoxfQ=="

My guess is that your API key in the top example with just basic auth is incorrect. You're using that same key in the authorization header of the second example. And the reason the second example works is likely that you're also using basic auth with a different key that I'd assume is actually valid.

miguelemosreverte · 2020-07-27T17:25:14Z

Yeah, you are most probably right. It's just that I experienced this issue and the fix was to add the auth header.

If no one else experiences this issue, then it must have been just me.

Most probably, (like, 99%), Grizzly works fine.

Just to make sure, I will try to reproduce this issue in a step by step scenario, and document everything. It Grizzly works our of the box, then this Issue was non existant. Else, well, we would have proven the bug!

Just a sec, BRB

miguelemosreverte · 2020-07-27T17:27:54Z

The bug | Step by Step

1. checkout Grizzly master, build and setup

2. Create Grafana API key

3. Use

miguelemosreverte · 2020-07-27T17:31:38Z

The solution | Step by step

1. Perform checkout of branch that uses an AuthorizationHeader

2. Same API key, the one I just created before, no changes there

3. Use

PatMis16 · 2021-12-16T11:03:04Z

Is there a solution to this? I couldn't find the branch AuthorizationHeader.

miguelemosreverte · 2021-12-16T11:38:04Z

They closed my branch PR, was here. Want to reopen?
#27

PatMis16 · 2021-12-16T12:22:33Z

Hi Miguel That would be helpful! Yes, please! Thanks! KR, Patrick Von meinem iPhone gesendet

…

Am 16.12.2021 um 12:38 schrieb Miguel Lemos ***@***.***>: They closed my branch PR, was here. Want to reopen? #27 — You are receiving this because you commented. Reply to this email directly, view it on GitHub, or unsubscribe. Triage notifications on the go with GitHub Mobile for iOS or Android.

miguelemosreverte · 2021-12-16T12:37:57Z

Oh, I don't have permissions to reopen the PR

miguelemosreverte · 2021-12-16T12:39:09Z

@PatMis16 I think if you can confirm reproduction of the bug they will consider reopening the PR.
@malcolmholmes

PatMis16 · 2021-12-16T12:47:21Z

Whether it is considered as a bug or not is a matter of the viewing point. However, in some setups there is no basic authentication possible, because the Grafana instance is behind a reverse proxy.

We would like to automate some things with Grizzly and it would be very helpful if we could connect through the proxy.
From this point of view, it can be seen an inhibiting limitation of Grizzly.

@malcolmholmes Please reopen the bug. If the PR is available again we can apply the changes to the latest version.

PatMis16 · 2021-12-16T14:25:31Z

Miguel, did you make the changes in the config.go or another file ? Von: Miguel Lemos ***@***.***> Gesendet: Donnerstag, 16. Dezember 2021 13:39 An: grafana/grizzly ***@***.***> Cc: PatMis16 ***@***.***>; Mention ***@***.***> Betreff: Re: [grafana/grizzly] HTTP 401 Unauthorized (#26) @PatMis16 <https://github.com/PatMis16> I think if you can confirm reproduction of the bug they will consider reopening the PR. @malcolmholmes <https://github.com/malcolmholmes> — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#26 (comment)> , or unsubscribe <https://github.com/notifications/unsubscribe-auth/AFSMRTN3PQSJXBAY2WCTJF3URHMXPANCNFSM4PI5WRUA> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub> . <https://github.com/notifications/beacon/AFSMRTL6BDHBRJZKWBRXAK3URHMXPA5CNFSM4PI5WRUKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOHNNGIVI.gif>

miguelemosreverte · 2021-12-16T16:26:24Z

I did, @PatMis16
Changes: https://github.com/grafana/grizzly/pull/27/files
Files changed:

go.mod (require oauth2)
go.sum (require oauth2)
pkg/grizzly/config.go (add the Grafanatoken to the type Config)
pkg/grizzly/grafana.go (use the Config + GrafanaToken to hit the HTTP endpoints using an http client that is authenticated thanks to the GrafanaToken)

PatMis16 · 2021-12-20T06:45:15Z

Thank you @miguelemosreverte

However, it looks like a lot of things have changed in the current release. I am concerned to break things.

Regards,
Patrick

PatMis16 · 2022-01-03T07:34:18Z

It shouldn't make a difference. In the docs right below where your screen shot cuts off, it states:

The API Token can also be passed as a Basic authorization password with the special username api_key...

Furthermore, it looks like your API key may be copied incorrectly in your examples.
curl http://api_key:eyJrIjoielBIZ1BYdWJVRWVQQ2dKYkM4S0ZQcmtDd3NSa2hCZFQiLCJuIjoiYXBpX2tleSIsImlkIjoxfQ==@localhost:3000/api/org

curl http://api_key:eyJrIjoiT0tTcG1pUlY2RnVKZTFVaDFeyJrIjoielBIZ1BYdWJVRWVQQ2dKYkM4S0ZQcmtDd3NSa2hCZFQiLCJuIjoiYXBpX2tleSIsImlkIjoxfQ==@localhost:3000/api/org  -H "Authorization: Bearer eyJrIjoidnBBaXhUdVQyS0VaWlJ4bGR6YWF4M3h4U3RTdllQem4iLCJuIjoiYXBpX2tleSIsImlkIjoxfQ=="
My guess is that your API key in the top example with just basic auth is incorrect. You're using that same key in the authorization header of the second example. And the reason the second example works is likely that you're also using basic auth with a different key that I'd assume is actually valid.

There is another angle which has an impact to this issue. There are enviornments, where basic authentication is not pass through e.g. if the Grafana sits behind a proxy, which normaly handles the authentication via an OpenID provider or something similar. In such a scenario it is well possible, that the basic auth requests are not forwarded to the grafana instance by the proxy. However, if a request contains an authentication header with the baerer token it is passed through. Therefore I think it is neccessary to add the authentication header method to grizzly.

tamirshaul · 2022-01-04T08:07:04Z

I am experiencing this issue as well.
We use Amazon Managed Grafana which does not allow Basic authentication.

further details here: #196

PatMis16 · 2022-01-04T08:36:23Z

I am experiencing this issue as well. We use Amazon Managed Grafana which does not allow Basic authentication.

further details here: #196

Hi @tamirshaul
I have implemented some changes and created a pull request (#197)
Maybe the changes work for you.
Regards,
Patrick

HabibMAALEM · 2022-10-25T13:14:24Z

Hi,

Actuallty, Grizzly use only Bearer Authentication (Hardcoded)

Why not make this dynamic depending on user credentials :

If user provide Username/Password => use Basic Authentication
If user provide Token (Api Key) => use Bearer Authentication

malcolmholmes · 2022-10-27T13:41:15Z

@HabibMAALEM what benefit would this give?

der-eismann · 2023-03-09T13:51:14Z

Actually according to the docs this should work already, but it seems that is not the case:

GRAFANA_USER: Basic auth username if applicable.
GRAFANA_TOKEN: Basic auth password or API token.

So it kind of feels like #197 broke the basic auth? With the 0.2.0-beta3 I can use the basic auth credentials as expected.

jannisy · 2023-06-05T09:53:03Z

Same here, basic auth works with 0.2.0-beta3 but not 0.2.0, nor 0.2.1.

Issue: #26 To verify issues like above, we need to be able to test with various auth methods This adds a `basic_auth` context (and instance) and adds the functionality to run the same test on all contexts Also, I changed from the `RunTests` function to individual t.Run. This is helpful because vscode can now see the individual tests and we can run them individually

) Issue: #26 To verify issues like above, we need to be able to test with various auth methods This adds a `basic_auth` context (and instance) and adds the functionality to run the same test on all contexts Also, I changed from the `RunTests` function to individual t.Run. This is helpful because vscode can now see the individual tests and we can run them individually

miguelemosreverte mentioned this issue Jul 27, 2020

Use the Grafana token in all requests in the Authorization header #27

Closed

julienduchesne self-assigned this Feb 1, 2024

julienduchesne mentioned this issue Feb 1, 2024

Integration: Add utility to run the same test on multiple contexts #323

Merged

julienduchesne linked a pull request Feb 1, 2024 that will close this issue

Integration: Add utility to run the same test on multiple contexts #323

Merged

julienduchesne closed this as completed in #323 Feb 2, 2024

lorrrrrrrenzo mentioned this issue Jun 10, 2024

[Bug]: 401 Unauthorized Errors when selecting a dashbaord #454

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

HTTP 401 Unauthorized #26

HTTP 401 Unauthorized #26

miguelemosreverte commented Jul 27, 2020

miguelemosreverte commented Jul 27, 2020

miguelemosreverte commented Jul 27, 2020

trotttrotttrott commented Jul 27, 2020

miguelemosreverte commented Jul 27, 2020

miguelemosreverte commented Jul 27, 2020

miguelemosreverte commented Jul 27, 2020

PatMis16 commented Dec 16, 2021

miguelemosreverte commented Dec 16, 2021

PatMis16 commented Dec 16, 2021 via email

miguelemosreverte commented Dec 16, 2021

miguelemosreverte commented Dec 16, 2021

PatMis16 commented Dec 16, 2021 •

edited

PatMis16 commented Dec 16, 2021 via email

miguelemosreverte commented Dec 16, 2021

PatMis16 commented Dec 20, 2021 •

edited

PatMis16 commented Jan 3, 2022

tamirshaul commented Jan 4, 2022

PatMis16 commented Jan 4, 2022

HabibMAALEM commented Oct 25, 2022

malcolmholmes commented Oct 27, 2022

der-eismann commented Mar 9, 2023 •

edited

jannisy commented Jun 5, 2023

HTTP 401 Unauthorized #26

HTTP 401 Unauthorized #26

Comments

miguelemosreverte commented Jul 27, 2020

the bug

miguelemosreverte commented Jul 27, 2020

the explanation

miguelemosreverte commented Jul 27, 2020

the solution

trotttrotttrott commented Jul 27, 2020

miguelemosreverte commented Jul 27, 2020

miguelemosreverte commented Jul 27, 2020

The bug | Step by Step

1. checkout Grizzly master, build and setup

2. Create Grafana API key

3. Use

miguelemosreverte commented Jul 27, 2020

The solution | Step by step

1. Perform checkout of branch that uses an AuthorizationHeader

2. Same API key, the one I just created before, no changes there

3. Use

PatMis16 commented Dec 16, 2021

miguelemosreverte commented Dec 16, 2021

PatMis16 commented Dec 16, 2021 via email

miguelemosreverte commented Dec 16, 2021

miguelemosreverte commented Dec 16, 2021

PatMis16 commented Dec 16, 2021 • edited

PatMis16 commented Dec 16, 2021 via email

miguelemosreverte commented Dec 16, 2021

PatMis16 commented Dec 20, 2021 • edited

PatMis16 commented Jan 3, 2022

tamirshaul commented Jan 4, 2022

PatMis16 commented Jan 4, 2022

HabibMAALEM commented Oct 25, 2022

malcolmholmes commented Oct 27, 2022

der-eismann commented Mar 9, 2023 • edited

jannisy commented Jun 5, 2023

PatMis16 commented Dec 16, 2021 •

edited

PatMis16 commented Dec 20, 2021 •

edited

der-eismann commented Mar 9, 2023 •

edited