Bug (v5-beta1) GitHub Login

[Xopherus]

I'm using the new v5 beta with the github auth plugin.

Here's our config:

[auth.github]
enabled = true
allow_sign_up = true
client_id = ${github_client_id}
client_secret = ${github_client_secret}
scopes = user:email,read:org
auth_url = https://github.com/login/oauth/authorize
token_url = https://github.com/login/oauth/access_token
api_url = https://api.github.com/user
team_ids = ${github_team_id}
allowed_organizations = ${github_team_name}

When a user (who belongs to the github organization) attempts to login we receive:

I was able to get some info from the logs:

t=2018-02-07T14:51:24+0000 lvl=info msg="Request Completed" logger=context userId=0 orgId=0 uname= method=GET path=/login/github status=302 remote_addr=10.x.x.x. time_ms=0 size=304 referer=https://grafana.mydomain.com/login
t=2018-02-07T14:51:25+0000 lvl=eror msg="User not a member of one of the required organizations" logger=context userId=0 orgId=0 uname=

[DanCech]

Have you verified that the ${github_team_name} in your config matches your github organization? If you are using team_ids then you can also just set allowed_organizations = since you're already restricting by team id which is more specific anyway.

[Xopherus]

Yep, I've verified that. Those have not changed during the upgrade. 4.6 was stable with that configuration, the 5.0 beta is not.

[Xopherus]

This seems to be related to the changes in #10112, specifically if your user is a member of a private GitHub org.

I can lookup my user to get the organization URL:

curl -H "Authorization: token foobar" https://api.github.com/user

{
  "login": "Xopherus",
  "organizations_url": "https://api.github.com/users/Xopherus/orgs",
  "type": "User",
}

Then if I curl the organization_url returned in that response, I don't get back all of the orgs I belong to.

curl -H "Authorization: token foobar" https://api.github.com/users/Xopherus/orgs

[
  {
    "login": "zerofox-oss",
    "url": "https://api.github.com/orgs/zerofox-oss",
  }
]

It seems like we should be using GET /user/orgs instead of GET /user/:user/orgs. That way if you're running Grafana with a private GitHub org you can still login.

[IngmarStein]

We've just updated from 4.6.3 to 5.0.0 beta 3 and GitHub authentication now results in the "User not a member of one of the required organizations". The configuration is supplied through environment variables and is unchanged from the previous version which authenticated successfully.

[inish777]

@IngmarStein @torkelo I'll investigate it and fix in 24 hours

[pesimon]

Seeing same issue here with priv Github Org and 5.0.0-beta4

[torkelo]

fix is coming in beta5 (or get it now in nightly build), reverted the #10823 change that caused the issue

[pesimon]

Just checked Grafana v5.0.0-beta4 (commit: 3964d6b) but still
t=2018-02-20T15:47:26+0000 lvl=eror msg="User not a member of one of the required organizations" logger=context userId=0 orgId=0 uname= unfortunately.

[pesimon]

#11028 works. thx a lot