I'm developing a Cloudformation template to create a Cognito User Pool and then configure Grafana 6.0.2 with the entries to use that pool for Oauth sign-up and login. It works partly now, but I have two bad behaviours (and maybe others I don't know about yet).
1) After creating a new account, even in an Incognito browser window, I receive this error: 'login.OAuthLogin(missing saved state)'.
2) If I return to the Grafana home page, and select 'Oauth login', I'm immediately logged in as that new user, with no chance to provide another user name.
I created a Cognito User Pool manually, and have had that work properly. I've attempted to re-create that in CloudFormation.
Python snipped from my Cloudformation template to configure/create the Cognito User Pool & Client:
CreateUserPoolAndClientFunction:
Type: AWS::Lambda::Function
Properties:
Handler: index.handler
Role: !GetAtt LambdaExecutionRole.Arn
Runtime: python3.6
Timeout: 60
Code:
ZipFile: |
import boto3
import cfnresponse
def handler(event, context):
responseData = {}
print (str(event))
try:
if event['RequestType'] == 'Create':
Environment = event['ResourceProperties']['Environment']
BaseUrl = event['ResourceProperties']['BaseUrl']
client = boto3.client('cognito-idp')
response = client.create_user_pool(
PoolName=Environment+'-userpool',
AutoVerifiedAttributes=['email'],
Schema=[
{
'Name': 'email',
'Required': True
}
]
)
CreatedUserPoolId = response['UserPool']['Id']
response = client.create_user_pool_client(
UserPoolId=CreatedUserPoolId,
GenerateSecret=True,
ClientName=Environment + '-client',
ReadAttributes=[
'address', 'birthdate', 'email', 'email_verified', 'family_name', 'gender', 'given_name', 'locale', 'middle_name', 'name', 'nickname', 'phone_number', 'phone_number_verified', 'picture', 'preferred_username', 'profile', 'updated_at', 'website', 'zoneinfo'
],
WriteAttributes=[
'address', 'birthdate', 'email', 'family_name', 'gender', 'given_name', 'locale', 'middle_name', 'name', 'nickname', 'phone_number', 'picture', 'preferred_username', 'profile', 'updated_at', 'website', 'zoneinfo'
],
SupportedIdentityProviders=['COGNITO'],
CallbackURLs=['https://' + BaseUrl + '','https://' + BaseUrl + '/login','https://' + BaseUrl + '/login/generic_oauth'],
LogoutURLs=['https://' + BaseUrl + '/login','https://' + BaseUrl + '/logout'],
AllowedOAuthFlows=['implicit','code'],
AllowedOAuthScopes=['email','openid','profile'],
AllowedOAuthFlowsUserPoolClient=True
)
CreatedClientId = response['UserPoolClient']['ClientId']
CreatedClientSecret = response['UserPoolClient']['ClientSecret']
response = client.create_user_pool_domain(
Domain = str(CreatedClientId),
UserPoolId = CreatedUserPoolId
)
responseData['UserPoolId'] = CreatedUserPoolId
responseData['ClientId'] = CreatedClientId
responseData['ClientSecret'] = CreatedClientSecret
print("SUCCESS, ResponseData=" + str(responseData))
cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData, "CustomResourcePhysicalID")
else:
print("SUCCESS - operation not Create, ResponseData=" + str(responseData))
cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData, "CustomResourcePhysicalID")
except Exception as e:
responseData['Error'] = str(e)
cfnresponse.send(event, context, cfnresponse.FAILED, responseData, "CustomResourcePhysicalID")
print("FAILED ERROR: " + responseData['Error'])
Generic Oauth section from my Grafana ini file:
[auth.generic_oauth]
enabled = true
name = OAuth
allow_sign_up = true
client_id = 6ghk6ekcdb7um021jcu5prdq6d
client_secret = 1090coldi5hba8ha9c52pq4f09hi2fm0mu5rqua7raaf9oqbq58
;scopes = user:email,read:org
scopes = openid profile email
auth_url = https://6ghk6ekcdb7um021jcu5prdq6d.auth.ap-southeast-2.amazoncognito.com/oauth2/authorize
token_url = https://6ghk6ekcdb7um021jcu5prdq6d.auth.ap-southeast-2.amazoncognito.com/oauth2/token
api_url = https://6ghk6ekcdb7um021jcu5prdq6d.auth.ap-southeast-2.amazoncognito.com/oauth2/userInfo
The 'BaseUrl' passed into the Cloudformation template will be something like 'grafana.oursite.com', and is a domain managed by AWS providing HTTPS. The 'client_id' used in the Grafana ini file is the Cognito User Pool ID, and Cognito uses that for the Oauth URLs (AFAIK).
Speculation can be helpful, but please say whether you know or are speculating - I'm doing this for a client and I'm on a deadline. I'm not very knowledgeable on any of this, so feel free to say more rather than less.
Thanks.