Grafana service account method

nickjmv commented 1 year ago

Hi,

I was trying out the apikey method. But since Grafana has removed the API keys from their system and migrated to a service account I'm in need of a new method.

Also, I wasn't able to get the apikey method to work with the following config:

general:
  kiosk-mode: full
  autofit: false
  lxde: false
  lxde-home: /home/pi

target:
  login-method: apikey
  username: "rpi"
  apikey: "XXX"
  playlists: true
  URL: https://grafana.domain.com/playlists/play/1
  ignore-certificate-errors: false

Can anyone point me in the correct direction?

jetxr commented 1 year ago

I was just trying to get it working, and using Service Account Tokens worked for me.

This is what I used: ./bin/grafana-kiosk -URL=https://myinstance.grafana.net/playlists/play/a979f316-4d58-4689-a510-2e6ef824a416 -login-method=apikey -apikey=<service_account_token> -kiosk-mode=full -playlists -autofit=true

In your config file, could you try removing the username field under target, and passing the Service Account's token in the apikey field.

Also:

I'm using Grafana Cloud
Using a Service Account with the "Viewer" permission
Created a Service Account Token (this value gets passed instead of the API key)
You can test if your credentials work with curl -H "Authorization: Bearer <service_account_token>" -X GET '<grafana_url>/api/access-control/user/permissions'

If that doesn't work, post the error message, the issue you notice.. someone else could have a solution.

nickjmv commented 1 year ago

I tried executing your command on our server, but unfortunately, I got the following error.

root@01624:/opt/grafana-kiosk# /usr/local/bin/grafana-kiosk --URL=https://grafana.domain.com/playlists/play/1 --login-method=apikey --apikey=xxxxxxx --kiosk-mode=full --playlists -autofit=false
GrafanaKiosk Version: v1.0.6
2023/06/09 14:24:38 No config specified, using environment and args
2023/06/09 14:24:38 AutoFit: false
2023/06/09 14:24:38 LXDEEnabled: false
2023/06/09 14:24:38 LXDEHome: /home/pi
2023/06/09 14:24:38 Mode: full
2023/06/09 14:24:38 WindowPosition: 0,0
2023/06/09 14:24:38 WindowSize: 
2023/06/09 14:24:38 URL: https://grafana.domain.com/playlists/play/1
2023/06/09 14:24:38 LoginMethod: apikey
2023/06/09 14:24:38 Username: guest
2023/06/09 14:24:38 Password: *redacted*
2023/06/09 14:24:38 IgnoreCertificateErrors: false
2023/06/09 14:24:38 IsPlayList: true
2023/06/09 14:24:38 UseMFA: false
2023/06/09 14:24:38 Fieldname AutoLogin: false
2023/06/09 14:24:38 Fieldname Username: username
2023/06/09 14:24:38 Fieldname Password: password
2023/06/09 14:24:38 DISPLAY not set, autosetting to :0.0
2023/06/09 14:24:38 DISPLAY= :0.0
2023/06/09 14:24:38 XAUTHORITY not set, autosetting
2023/06/09 14:24:38 XAUTHORITY= /root/.Xauthority
2023/06/09 14:24:38 method  apikey
2023/06/09 14:24:38 Launching apikey kiosk
2023/06/09 14:24:38 Using temp dir: /tmp/chromedp-kiosk1346209397
panic: chrome failed to start:
/bin/bash: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
BlueALSA detected - Disabling audio sandbox
No protocol specified
[0609/142440.029695:ERROR:elf_dynamic_array_reader.h(61)] tag not found

goroutine 1 [running]:
github.com/grafana/grafana-kiosk/pkg/kiosk.GrafanaKioskApikey(0x2532400, 0x242ed40)
        /home/runner/work/grafana-kiosk/grafana-kiosk/pkg/kiosk/apikey_login.go:36 +0x7b8
main.main()
        /home/runner/work/grafana-kiosk/grafana-kiosk/pkg/cmd/grafana-kiosk/main.go:232 +0xa74

OR via my config file:

general:
  kiosk-mode: full
  autofit: false
  lxde: false
  lxde-home: /home/pi

target:
  login-method: apikey
  apikey: "xxx"
  playlists: true
  URL: https://grafana.domain.com/playlists/play/1
  ignore-certificate-errors: false

I still get the same error when the kiosk opens: Invalid basic auth header

toddwh50 commented 1 year ago

I get the same thing: Invalid Basic Auth Header

Configured very similar to nickjmv above, except I'm hitting AWS Managed Grafana. I've tried with API keys and Service Account tokens. Same result.

jetxr commented 1 year ago

Not that I have a solution, but tried searching for the above error (elf_dynamic_array_reader.h(61)] tag not found), and the only other places I found it were #50 and some issues in other projects dealing with Chromium.

What OS, browser, etc. are you'll using?

nickjmv commented 1 year ago

@jetxr I'm using:

No LSB modules are available.
Distributor ID: Raspbian
Description:    Raspbian GNU/Linux 11 (bullseye)
Release:        11
Codename:       bullseye

And for the browser:

Chromium 116.0.5845.102 Built on Raspbian, running on Raspbian 11

wizpresso-steve-cy-fan commented 1 year ago

Actually...the API key field is in its own YAML key: https://github.com/grafana/grafana-kiosk/blob/8c5d4894c503db394f74d774e7485a46b93a586b/pkg/kiosk/config.go#L34-L36

So do this:

general:
  kiosk-mode: full
  autofit: true

target:
  login-method: apikey
  playlist: false
  URL: https://grafana.foo.com
  ignore-certificate-errors: false

apikey:
  apikey: glsa_foobarbaz

nickjmv commented 2 months ago

@wizpresso-steve-cy-fan I have finally been able to pick up my 'project' again and I can confirm your solution works!

grafana / grafana-kiosk

Grafana service account method #110