Add per-user authentication feature

.changeset/curvy-lizards-report.md

@@ -0,0 +1,5 @@
+---
+'grafana-zabbix': major
+---
+
+Add the ability to have per-user authentication

.github/workflows/compatibility-60.yml

@@ -32,6 +32,7 @@ jobs:
           ZABBIX_URL: 'https://localhost/api_jsonrpc.php'
           ZABBIX_USER: 'Admin'
           ZABBIX_PASSWORD: 'zabbix'
+          ZABBIX_TARGET_USER: 'grafana_test'
         run: go test -v ./pkg/zabbixapi/...
 
       - name: Cleanup

.github/workflows/compatibility-70.yml

@@ -32,6 +32,7 @@ jobs:
           ZABBIX_URL: 'https://localhost/api_jsonrpc.php'
           ZABBIX_USER: 'Admin'
           ZABBIX_PASSWORD: 'zabbix'
+          ZABBIX_TARGET_USER: 'grafana_test'
         run: go test -v ./pkg/zabbixapi/...
 
       - name: Cleanup

.github/workflows/compatibility-72.yml

@@ -32,6 +32,7 @@ jobs:
           ZABBIX_URL: 'http://localhost:8188/api_jsonrpc.php'
           ZABBIX_USER: 'Admin'
           ZABBIX_PASSWORD: 'zabbix'
+          ZABBIX_TARGET_USER: 'grafana_test'
         run: go test -v ./pkg/zabbixapi/...
 
       - name: Cleanup

.github/workflows/compatibility-74.yml

@@ -32,6 +32,7 @@ jobs:
           ZABBIX_URL: 'http://localhost:8188/api_jsonrpc.php'
           ZABBIX_USER: 'Admin'
           ZABBIX_PASSWORD: 'zabbix'
+          ZABBIX_TARGET_USER: 'grafana_test'
         run: go test -v ./pkg/zabbixapi/...
 
       - name: Cleanup

README.md

@@ -15,6 +15,7 @@
 - Transform and shape your data with [metric processing functions](https://grafana.com/docs/plugins/alexanderzobnin-zabbix-app/latest/reference/functions/) (Avg, Median, Min, Max, Multiply, Summarize, Time shift, Alias)
 - Find problems faster with [Alerting](https://grafana.com/docs/plugins/alexanderzobnin-zabbix-app/latest/reference/alerting/) feature
 - Mix metrics from multiple data sources in the same dashboard or even graph
+- Per user authentication using Bearer tokens, so that Grafana respects the RBAC on Zabbix
 - Discover and share [dashboards](https://grafana.com/dashboards) in the official library
 
 See all features overview and dashboards examples at Grafana-Zabbix [Live demo](http://play.grafana-zabbix.org) site.

devenv/zabbix60/bootstrap/Dockerfile

@@ -5,6 +5,8 @@ ENV ZBX_API_USER="Admin"
 ENV ZBX_API_PASSWORD="zabbix"
 ENV ZBX_CONFIG="zbx_export_hosts.xml"
 ENV ZBX_BOOTSTRAP_SCRIPT="bootstrap_config.py"
+ENV ZBX_TEST_USER="grafana_test"
+ENV ZBX_TEST_PASS="grafana_test_pass"
 
 RUN pip install pyzabbix
 

devenv/zabbix60/bootstrap/bootstrap_config.py

@@ -5,7 +5,9 @@
 zabbix_url = os.environ['ZBX_API_URL']
 zabbix_user = os.environ['ZBX_API_USER']
 zabbix_password = os.environ['ZBX_API_PASSWORD']
-print(zabbix_url, zabbix_user, zabbix_password)
+zabbix_test_user = os.environ['ZBX_TEST_USER']
+zabbix_test_pass = os.environ['ZBX_TEST_PASS']
+print(zabbix_url, zabbix_user, zabbix_password, zabbix_test_user, zabbix_test_pass)
 
 zapi = ZabbixAPI(zabbix_url, timeout=5)
 
@@ -76,5 +78,27 @@
   except ZabbixAPIException as e:
     print e
 
+print("Creating a user for testing per-user auth")
+groups = zapi.usergoup.get(output="extend", filter={"name": "Zabbix administrators"})
+if not groups:
+  groups = zapi.usergroup.get(output="extend")
+groupid = groups[0]['usrgrpid']
+
+user_create_params = {
+  "alias": zabbix_test_user,
+  "passwd": zabbix_test_pass,
+  "name": "Grafana",
+  "surname": "Test",
+  "type": 1,  # Zabbix user type
+  "user_groups": [{"usrgrpid": groupid}],
+}
+
+try:
+  user = zapi.user.create(**user_create_params)
+  print("User created successfully: %s" % user['userids'][0])
+except Exception as e:
+  print("Failed to create user: %s" % e)
+
+
 for h in zapi.host.get(output="extend"):
     print(h['name'])

devenv/zabbix60/docker-compose.yml

@@ -88,6 +88,8 @@ services:
       ZBX_API_URL: http://zabbix-web:8080
       ZBX_API_USER: Admin
       ZBX_API_PASSWORD: zabbix
+      ZBX_TEST_USER: grafana_test
+      ZBX_TEST_PASS: grafana_test_pass
     depends_on:
       - database
       - zabbix-server

devenv/zabbix70/bootstrap/Dockerfile

@@ -5,6 +5,8 @@ ENV ZBX_API_USER="Admin"
 ENV ZBX_API_PASSWORD="zabbix"
 ENV ZBX_CONFIG="zbx_export_hosts.json"
 ENV ZBX_BOOTSTRAP_SCRIPT="bootstrap_config.py"
+ENV ZBX_TEST_USER="grafana_test"
+ENV ZBX_TEST_PASS="grafana_test_pass"
 
 RUN pip install zabbix_utils
 

devenv/zabbix70/bootstrap/bootstrap_config.py

@@ -4,7 +4,9 @@
 zabbix_url = os.environ['ZBX_API_URL']
 zabbix_user = os.environ['ZBX_API_USER']
 zabbix_password = os.environ['ZBX_API_PASSWORD']
-print(zabbix_url, zabbix_user, zabbix_password)
+zabbix_test_user = os.environ['ZBX_TEST_USER']
+zabbix_test_pass = os.environ['ZBX_TEST_PASS']
+print(zabbix_url, zabbix_user, zabbix_password, zabbix_test_user, zabbix_test_pass)
 
 zapi = ZabbixAPI(zabbix_url)
 
@@ -71,5 +73,26 @@
   except Exception as e:
     print(e)
 
+print("Creating a user for testing per-user auth")
+groups = zapi.usergoup.get(output="extend", filter={"name": "Zabbix administrators"})
+if not groups:
+  groups = zapi.usergroup.get(output="extend")
+groupid = groups[0]['usrgrpid']
+
+user_create_params = {
+  "alias": zabbix_test_user,
+  "passwd": zabbix_test_pass,
+  "name": "Grafana",
+  "surname": "Test",
+  "type": 1,  # Zabbix user type
+  "user_groups": [{"usrgrpid": groupid}],
+}
+
+try:
+  user = zapi.user.create(**user_create_params)
+  print("User created successfully: %s" % user['userids'][0])
+except Exception as e:
+  print("Failed to create user: %s" % e)
+
 for h in zapi.host.get(output="extend"):
     print(h['name'])

devenv/zabbix70/docker-compose.yml

@@ -88,6 +88,8 @@ services:
       ZBX_API_URL: http://zabbix-web:8080
       ZBX_API_USER: Admin
       ZBX_API_PASSWORD: zabbix
+      ZBX_TEST_USER: grafana_test
+      ZBX_TEST_PASS: grafana_test_pass
     depends_on:
       - database
       - zabbix-server

devenv/zabbix72/bootstrap/Dockerfile

@@ -5,6 +5,8 @@ ENV ZBX_API_USER="Admin"
 ENV ZBX_API_PASSWORD="zabbix"
 ENV ZBX_CONFIG="zbx_export_hosts.json"
 ENV ZBX_BOOTSTRAP_SCRIPT="bootstrap_config.py"
+ENV ZBX_TEST_USER="grafana_test"
+ENV ZBX_TEST_PASS="grafana_test_pass"
 
 RUN pip install zabbix_utils
 

devenv/zabbix72/bootstrap/bootstrap_config.py

@@ -4,7 +4,9 @@
 zabbix_url = os.environ['ZBX_API_URL']
 zabbix_user = os.environ['ZBX_API_USER']
 zabbix_password = os.environ['ZBX_API_PASSWORD']
-print(zabbix_url, zabbix_user, zabbix_password)
+zabbix_test_user = os.environ['ZBX_TEST_USER']
+zabbix_test_pass = os.environ['ZBX_TEST_PASS']
+print(zabbix_url, zabbix_user, zabbix_password, zabbix_test_user, zabbix_test_pass)
 
 zapi = ZabbixAPI(zabbix_url)
 
@@ -71,5 +73,26 @@
   except Exception as e:
     print(e)
 
+print("Creating a user for testing per-user auth")
+groups = zapi.usergoup.get(output="extend", filter={"name": "Zabbix administrators"})
+if not groups:
+  groups = zapi.usergroup.get(output="extend")
+groupid = groups[0]['usrgrpid']
+
+user_create_params = {
+  "alias": zabbix_test_user,
+  "passwd": zabbix_test_pass,
+  "name": "Grafana",
+  "surname": "Test",
+  "type": 1,  # Zabbix user type
+  "user_groups": [{"usrgrpid": groupid}],
+}
+
+try:
+  user = zapi.user.create(**user_create_params)
+  print("User created successfully: %s" % user['userids'][0])
+except Exception as e:
+  print("Failed to create user: %s" % e)
+
 for h in zapi.host.get(output="extend"):
     print(h['name'])

devenv/zabbix72/docker-compose.yml

@@ -69,6 +69,8 @@ services:
       ZBX_API_URL: http://zabbix-web:8080
       ZBX_API_USER: Admin
       ZBX_API_PASSWORD: zabbix
+      ZBX_TEST_USER: grafana_test
+      ZBX_TEST_PASS: grafana_test_pass
     depends_on:
       - database
       - zabbix-server

devenv/zabbix74/bootstrap/Dockerfile

@@ -5,6 +5,8 @@ ENV ZBX_API_USER="Admin"
 ENV ZBX_API_PASSWORD="zabbix"
 ENV ZBX_CONFIG="zbx_export_hosts.json"
 ENV ZBX_BOOTSTRAP_SCRIPT="bootstrap_config.py"
+ENV ZBX_TEST_USER="grafana_test"
+ENV ZBX_TEST_PASS="grafana_test_pass"
 
 RUN pip install zabbix_utils
 

devenv/zabbix74/bootstrap/bootstrap_config.py

@@ -4,7 +4,9 @@
 zabbix_url = os.environ['ZBX_API_URL']
 zabbix_user = os.environ['ZBX_API_USER']
 zabbix_password = os.environ['ZBX_API_PASSWORD']
-print(zabbix_url, zabbix_user, zabbix_password)
+zabbix_test_user = os.environ['ZBX_TEST_USER']
+zabbix_test_pass = os.environ['ZBX_TEST_PASS']
+print(zabbix_url, zabbix_user, zabbix_password, zabbix_test_user, zabbix_test_pass)
 
 zapi = ZabbixAPI(zabbix_url)
 
@@ -71,5 +73,26 @@
   except Exception as e:
     print(e)
 
+print("Creating a user for testing per-user auth")
+groups = zapi.usergoup.get(output="extend", filter={"name": "Zabbix administrators"})
+if not groups:
+  groups = zapi.usergroup.get(output="extend")
+groupid = groups[0]['usrgrpid']
+
+user_create_params = {
+  "alias": zabbix_test_user,
+  "passwd": zabbix_test_pass,
+  "name": "Grafana",
+  "surname": "Test",
+  "type": 1,  # Zabbix user type
+  "user_groups": [{"usrgrpid": groupid}],
+}
+
+try:
+  user = zapi.user.create(**user_create_params)
+  print("User created successfully: %s" % user['userids'][0])
+except Exception as e:
+  print("Failed to create user: %s" % e)
+
 for h in zapi.host.get(output="extend"):
     print(h['name'])

devenv/zabbix74/docker-compose.yml

@@ -69,6 +69,8 @@ services:
       ZBX_API_URL: http://zabbix-web:8080
       ZBX_API_USER: Admin
       ZBX_API_PASSWORD: zabbix
+      ZBX_TEST_USER: grafana_test
+      ZBX_TEST_PASS: grafana_test_pass
     depends_on:
       - database
       - zabbix-server

pkg/cache/token_cache.go

@@ -0,0 +1,57 @@
+package cache
+
+import (
+	"sync"
+	"time"
+)
+
+type TokenInfo struct {
+	Token     string
+	ExpiresAt time.Time
+	UserID    string
+	Username  string
+}
+
+type TokenCache struct {
+	tokens sync.Map // key: "datasourceUID:identity:userID"
+}
+
+func NewTokenCache() *TokenCache {
+	return &TokenCache{}
+}
+
+func (tc *TokenCache) Get(datasourceUID, identity, userID string) (*TokenInfo, bool) {
+	key := datasourceUID + ":" + identity + ":" + userID
+	if val, ok := tc.tokens.Load(key); ok {
+		tokenInfo := val.(*TokenInfo)
+		if time.Now().Before(tokenInfo.ExpiresAt) {
+			return tokenInfo, true
+		}
+		tc.tokens.Delete(key)
+	}
+	return nil, false
+}
+
+func (tc *TokenCache) Set(datasourceUID, identity, userID, token string, ttl time.Duration) {
+	key := datasourceUID + ":" + identity + ":" + userID
+	tokenInfo := &TokenInfo{
+		Token:     token,
+		ExpiresAt: time.Now().Add(ttl),
+		UserID:    userID,
+		Username:  identity,
+	}
+	tc.tokens.Store(key, tokenInfo)
+}
+
+func (tc *TokenCache) CleanupExpired() int {
+	count := 0
+	tc.tokens.Range(func(key, value interface{}) bool {
+		tokenInfo := value.(*TokenInfo)
+		if time.Now().After(tokenInfo.ExpiresAt) {
+			tc.tokens.Delete(key)
+			count++
+		}
+		return true
+	})
+	return count
+}