Hi there,
at the moment I’m trying to use AWS Cognito as oauth server for our Grafana installation (version 4.3.1)
I made the changes in the auth.generic_oauth section in the grafana.ini file.
Unfortunately i received the error message “create account failed”. After some research i found out that a user is added in the internal sqlite3 database with the information that is returned from the oauth server.
I opened the log file (level: trace) and found out that the returned information (of the token) from Cognito is empty.
See log entries:
t=2018-04-30T07:01:30+0000 lvl=info msg=“Request Completed” logger=context userId=0 orgId=0 uname= method=GET path=/login/generic_oauth status=302 remote_addr=MY_ADDRESS time_ms=0 size=355
t=2018-04-30T07:01:30+0000 lvl=dbug msg=“OAuthLogin Got token” logger=context userId=0 orgId=0 uname=
t=2018-04-30T07:01:30+0000 lvl=eror msg=“Invalid API key” logger=context error=“Invalid Api Key”
t=2018-04-30T07:01:30+0000 lvl=info msg=“Request Completed” logger=context userId=0 orgId=0 uname= method=GET path=/ status=401 remote_addr=GRAFANA_ADDR time_ms=0 size=29
t=2018-04-30T07:01:30+0000 lvl=eror msg=“Invalid API key” logger=context error=“Invalid Api Key”
t=2018-04-30T07:01:30+0000 lvl=info msg=“Request Completed” logger=context userId=0 orgId=0 uname= method=GET path=/emails status=401 remote_addr=GRAFANA_ADR time_ms=0 size=29
t=2018-04-30T07:01:30+0000 lvl=dbug msg=“OAuthLogin got user info” logger=context userId=0 orgId=0 uname= userInfo=“&{Name: Email: Login: Company: Role:}”
t=2018-04-30T07:01:30+0000 lvl=eror msg=“Failed to create account” logger=context userId=0 orgId=0 uname= error=“UNIQUE constraint failed: user.email”
t=2018-04-30T07:01:30+0000 lvl=eror msg=“Request Completed” logger=context userId=0 orgId=0 uname= method=GET path=/login/generic_oauth status=500 remote_addr=MY_ADDRESS time_ms=138 size=688
I’m not sure why the Invalid API key error occurs?
If i test with Postman no error occurs and also the token contains the requested information: openid + profile + email. I don’t know why Grafana isn’t able to receive this information.
As a second approach I added another app client without client_secret, but in this case Grafana returns an invalid_client error when communicating with AWS Cognito which is also a bit confusing for me because also this app client works when I test with postman…
It would be great if you could help me!
Best regards