Ufdjrw

I'm using grafana iframes in my HTML page running in k, but every time I open my page to view the embedded graphs I need to access grafana and thus login to authenticate my user, my Django application already has a login page, I would like to use only one login on my page and send a proxy request to grafana, so I do not need to perform two logins every time I open my application.

View

class GraphanaProxyView(ProxyView):
 upstream = 'http://172.30.3.141:3000/'

 def get_proxy_request_headers(self, request):
 headers = super(GraphanaProxyView, self).get_proxy_request_headers(request)
 headers['X-WEBAUTH-USER'] = request.user.username
 return headers

Urls

url(r'^grafana/(?P<path>.*)$', views.GraphanaProxyView.as_view(), name='graphana-dashboards'),

Config Grafana

grafana:
 image: grafana/grafana:latest
 container_name: grafana
 restart: always
 ports:
 - "3000:3000"
 volumes:
 - "./grafana/datastore:/var/lib/grafana"

 environment:
 - GF_SMTP_ENABLED=true 
 - GF_SMTP_HOST=smtp.gmail.com:587
 - GF_SMTP_USER=user@domain.com.br
 - GF_SMTP_PASSWORD=password
 - GF_SMTP_FROM_NAME=Grafana Snipped
 - GF_SMTP_SKIP_VERIFY=true


 - GF_AUTH_ANONYMOUS_ENABLED=true
 - GF_AUTH_ANONYMOUS_ORG_NAME=View
 - GF_AUTH_ANONYMOUS_ORG_ROLE=View
 - GF_USERS_ALLOW_SIGN_UP=false

 - GF_AUTH_PROXY_ENABLED=true
 - GF_AUTH_PROXY_HEADER_NAME = X-WEBAUTH-USER
 - GF_AUTH_PROXY_HEADER_PROPERTY=username 
 - GF_AUTH_PROXY_AUTO_SIGN_UP=true 
 - GF_AUTH_PROXY_LDAP_SYNC_TTL=60
 - GF_AUTH_PROXY_WHITELIST = 172.30.3.207
 - GF_SERVER_DOMAIN = 172.30.3.141

I'm getting this error when accessing URL:

If you're seeing this Grafana has failed to load its application files

1. This could be caused by your reverse proxy settings.




2. If you host grafana under subpath make sure your grafana.ini root_path setting includes subpath




3. If you have a local dev build make sure you build frontend using: npm run dev, npm run watch, or npm run build




4. Sometimes restarting grafana-server can help

thank you for contacting me by email also.

For the sake of completeness I re-post here the answered I have given to the original post in Stackoverflow Portugal: https://pt.stackoverflow.com/questions/362727/autentica%C3%A7%C3%A3o-single-sign-on-django-e-grafana

Your report is almost complete, great!

Given the warning

This setting is also important if you have a reverse proxy in front of Grafana that exposes it through a subpath. In that case add the subpath to the end of this URL setting.

at http://docs.grafana.org/installation/configuration/#root-url

a fault can be the setting of the GF_SERVER_DOMAIN envvar that should be replaced by the GF_SERVER_ROOT_URL=http://172.30.3.141:3000/ that holds the port (and this would mean a bug of Grafana documentation...)

If not this, only two other questions come to my mind to identify the issue:

1. does your request.user.username match the Grafana username?


2. what is the "src" attribute of your iframe? It must be https://172.30.3.207/grafana/(dashboard path)
   

beside this basic questions I suggest you to try to remove the GF_AUTH_PROXY_WHITELIST envvar and to try to authenticate via curl like:

curl -H "X-WEBAUTH-USER: anthony" http://172.30.3.141:3000/api/user

as you can find at http://docs.grafana.org/auth/auth-proxy/#interacting-with-grafana-s-authproxy-via-curl

Follows my Django view and my grafana config to reach the working result, but seen no meaningful differences:

class GraphanaProxyView(ProxyView):
upstream = 'http://localhost:8891/dashboard/'

def get_proxy_request_headers(self, request):
 headers = super(GraphanaProxyView, self).get_proxy_request_headers(request)
 headers['X-WEBAUTH-APP-USER'] = request.user.username
 return header

Grafana config:

[auth]
disable_login_form = true

[auth.proxy]
enabled = true
header_name = X-WEBAUTH-APP-USER
;header_property = username
;auto_sign_up = true
;ldap_sync_ttl = 60
whitelist = 127.0.0.1

[auth.basic]
enabled = false


[server]
protocol = http
http_addr = 127.0.0.1
http_port = 8891

domain = solomon.labs.befair.it
;enforce_domain = false
root_url = https://%(domain)s/ui/