Page MenuHomePhabricator

Login through Grafana using the login link do not work
Closed, ResolvedPublic

Description

Hi, have something changed with the login for Grafana? In my default browser Safari I get "You don't have permission to access this resource." I tried with Chrome and Firefox too and get the same. I cleared the browser cache too but no luck.

Screenshot 2024-11-05 at 08.30.24.png (244×868 px, 23 KB)

when I click on the login button from https://grafana.wikimedia.org/ and it goes to the page https://grafana.wikimedia.org/login that returns the error,

Event Timeline

hi, @Peter, thanks for the report; we're investigating; meanwhile, please try https://grafana-rw.wikimedia.org instead while we address this issue.

Hi @Peter , this is a known issue. We'll work on a fix for it, in the meantime, could you please try using https://grafana-rw.wikimedia.org/ to login?

andrea.denisse changed the task status from Open to In Progress.Nov 5 2024, 5:30 PM
andrea.denisse claimed this task.

There are two distinct behaviors when users access the Grafana login page at https://grafana.wikimedia.org/login, depending on the route they take to get there.

  1. Accessing via Grafana UI: If users reach the login page from within the Grafana UI, they encounter a message stating, "You don't have permission to access this resource."
  1. Direct Access: If users access the login page directly (without first interacting with the Grafana UI), they are successfully redirected to the IDP login page.

These behaviors are the result of rewrite rules in the Apache configuration for the Grafana hosts.

For behavior 1 (from the Grafana UI), the following lines in the Apache config are triggered:

RewriteCond "%{REQUEST_URI}" "^/login"
RewriteCond "%{HTTP_REFERER}" "^https://<%= @domain %>/d/(.*)"
RewriteRule "^" "https://<%= @domainrw %>/d/%1&forceLogin=true" [R=302,L,NE]

For behavior 2 (direct access), the following lines in the Apache config are triggered:

RewriteCond "%{REQUEST_URI}" "^/login"
RewriteRule "^" "https://<%= @domainrw %>" [R=302,L]

The HTTP_REFERER variable is used to redirect users back to the dashboard they were viewing after logging in to the grafana-rw host. This explains why the issue only occurs when accessing the login page via the Grafana UI, as it relies on the referring URL to handle redirection.

Peter renamed this task from Grafana login gives forbidden to Login through Grafana using the login link do not work.Nov 8 2024, 3:00 PM

Change #1088611 had a related patch set uploaded (by Andrea Denisse; author: Andrea Denisse):

[operations/puppet@production] grafana: Fix login redirection to preserve dashboard context

https://gerrit.wikimedia.org/r/1088611

Change #1088616 had a related patch set uploaded (by Andrea Denisse; author: Andrea Denisse):

[operations/puppet@production] grafana: Allow HTTP access from the deployment-hosts

https://gerrit.wikimedia.org/r/1088616

Change #1088616 merged by Andrea Denisse:

[operations/puppet@production] grafana: Allow HTTP access from the deployment-hosts

https://gerrit.wikimedia.org/r/1088616

Mentioned in SAL (#wikimedia-operations) [2024-11-08T21:18:07Z] <denisse> disabling Puppet on grafana2001 - T379043

Change #1088611 merged by Andrea Denisse:

[operations/puppet@production] grafana: Fix login redirection to preserve dashboard context

https://gerrit.wikimedia.org/r/1088611

The fix is deployed in production.