Authentication to data source failed: Grafana CheckMK plugin 4.0.2

Troubleshooting
, ,
1

CMK version:

2.4.0p1

OS version:

Container (Docker)

Error message: (in Grafana)

Authentication to data source failed

According to the GitHub release comments, the plugin 4.0.2 can also be used for the raw edition of checkmk. (However, the documentation Checkmk in Grafana integrieren does not seem to be up to date? It still suggests to use the unsigned version - and the picture of the plugin configuration page in Grafana looks different now).

Anyway, when creating a grafana user as described in the documentation and assigning a new role based on guest but with “User management” enabled and an authentication secret, that secret does not seem to do the trick when entered in the grafana plugin configuration. Clicking on “Save and test” results in the error “Authentication to data source failed.”.

~/var/log/web.log just says [cmk.web.auth 1422] Login failed for username: grafana (existing: Yes, locked: No, failed logins until locked: 1), and increasing the log level to debug does not anything relevant besides locking a file and releasing the lock after the authentication attempt.

Do I still have to use the legacy checkmk plugin 3.4.1 from November 2024? This is the last one that has the legacy plugin tribe-29-checkmk-datasource-3.4.0.zip. Or do I need to change from authentication secret to password?

Thanks,

sophonet

2

Hello,
Version 4.0.2 connects correctly to Checmk Raw Edition. The error is due to the automation user not having sufficient permissions. Please check again the documentation Checkmk in Grafana integrieren

3. Grafana-Benutzer in Checkmk erstellen

Die Grafana-Anbindung benötigt auf Seite von Checkmk einen Benutzer, der über ausreichende Berechtigungen verfügt und sich zudem über ein Automationspasswort (automation secret) statt eines Passworts authentifiziert. Normale Gast- oder Monitoring-Benutzer genügen nicht, aus Sicherheitsgründen sollten Sie jedoch keinen Administrator verwenden.

Best regards,
Leonardo

4

Hello Leonardo,

thanks for the fast response - well I have read the documentation and have followed the paragraph below the one you have cited:

Der einfachste Weg zu einem “passenden” Benutzer ist, die Rolle des Gastbenutzers (guest) zu klonen und mit der zusätzlichen Berechtigung User management (lesender Zugriff auf Benutzerinformationen) zu versehen. Falls Sie Ihre Grafana-Benutzerrolle auf einer anderen Rolle basieren lassen, achten Sie darauf, dass neben User management auch die Berechtigung See all host and services gesetzt ist.

So I have cloned the guest user and have added “User Management” permission. I also have just double-checked that “See all host and services” is enabled. I also have just double-checked that the grafana user has that custom role.

Are there more permissions that are required but not mentioned in the documentation?

Thanks and best regards,

sophonet

5

Hi,

quick update: I have temporarily set role of the grafana user to Administrator with the same behavior (same log entry in web.log and error message in grafana configuration page). When setting it back to the custom grafana role and setting the debugging level of “authentication” to debug, the connection suddenly started working successfully.

What I have done as well is mutually pinged the checkmk and grafana servers from inside the containers to check if the docker network has been configured correctly and I have recreated authentication secrets a couple of times.

Now I do not know what the cause has been for the problem (special characters in the secrets by accident?), but I guess I do not need further help now that things are working. At least the permissions mentioned in the documentation seem to be correct.

Thanks!