From 0618122bcd18525cfdb724f98832f9970e4a5a00 Mon Sep 17 00:00:00 2001 From: Daniel Lee Date: Fri, 18 Nov 2016 16:53:07 +0100 Subject: [PATCH] feat(httpsettings): add tls auth option - Three text areas where the user can paste in the CA Cert (optional), Client Cert and Client Key. - Tooltips for Auth checkboxes with brief descriptions of what With Credentials and With CA Cert are. - Adds popover for TLS Auth header too. - Aligns gf-form elements as labels and checkboxes were not aligned before. - Makes CA Cert optional as it is only needed for self-signed certs. --- pkg/api/dataproxy.go | 10 +- .../plugins/partials/ds_http_settings.html | 161 +++++++++++------- public/sass/components/_gf-form.scss | 8 + 3 files changed, 115 insertions(+), 64 deletions(-) diff --git a/pkg/api/dataproxy.go b/pkg/api/dataproxy.go index 4f2a2ebfce4..803d966ee18 100644 --- a/pkg/api/dataproxy.go +++ b/pkg/api/dataproxy.go @@ -31,18 +31,18 @@ func DataProxyTransport(ds *m.DataSource) (*http.Transport, error) { TLSHandshakeTimeout: 10 * time.Second, } - var tlsAuth bool - var err error + var tlsAuth, tlsAuthWithCACert bool if ds.JsonData != nil { - tlsAuth, err = ds.JsonData.Get("tlsAuth").Bool() + tlsAuth = ds.JsonData.Get("tlsAuth").MustBool(false) + tlsAuthWithCACert = ds.JsonData.Get("tlsAuthWithCACert").MustBool(false) } - if err == nil && tlsAuth { + if tlsAuth { transport.TLSClientConfig.InsecureSkipVerify = false decrypted := ds.SecureJsonData.Decrypt() - if len(decrypted["tlsCACert"]) > 0 { + if tlsAuthWithCACert && len(decrypted["tlsCACert"]) > 0 { caPool := x509.NewCertPool() ok := caPool.AppendCertsFromPEM([]byte(decrypted["tlsCACert"])) if ok { diff --git a/public/app/features/plugins/partials/ds_http_settings.html b/public/app/features/plugins/partials/ds_http_settings.html index 5d980f43fdd..6c116eef193 100644 --- a/public/app/features/plugins/partials/ds_http_settings.html +++ b/public/app/features/plugins/partials/ds_http_settings.html @@ -1,60 +1,69 @@
-

Http settings

+

Http settings

+
+
+
+ Url + + +

Specify a complete HTTP url (for example http://your_server:8080)

+ + Your access method is Direct, this means the url + needs to be accessable from the browser. + + + Your access method is currently Proxy, this means the url + needs to be accessable from the grafana backend. + + +
+
+ +
+
+ Access +
+ + + Direct = url is used directly from browser
+ Proxy = Grafana backend will proxy the request + +
+
+
+
+ +

Http Auth

-
- Url - - -

Specify a complete HTTP url (for example http://your_server:8080)

- - Your access method is Direct, this means the url - needs to be accessable from the browser. - - - Your access method is currently Proxy, this means the url - needs to be accessable from the grafana backend. - - -
-
- -
-
- Access -
- - - Direct = url is used directly from browser
- Proxy = Grafana backend will proxy the request - -
-
-
- -
-
- -
+ checked="current.basicAuth" label-class="width-8" switch-class="max-width-6"> - - + label="With Credentials" tooltip="Whether credentials such as cookies or auth headers should be sent with cross-site requests." + checked="current.withCredentials" label-class="width-11" switch-class="max-width-6">
+
+ + + + +
+
+
+
Basic Auth Details
User @@ -62,25 +71,59 @@
-
+
Password
+
-
- - Client Cert - - -
- -
- - Client Key - - -
+
+
+
TLS Auth Details
+ TLS Certs are encrypted and stored in the Grafana database. +
+
+
+
+ +
+
+ +
+ +
+ + reset +
+
+
+ +
+
+ +
+
+ +
+
+ + reset +
+
+ +
+
+ +
+
+ +
+
+ + reset +
+
diff --git a/public/sass/components/_gf-form.scss b/public/sass/components/_gf-form.scss index c22418d70da..42498c47ac3 100644 --- a/public/sass/components/_gf-form.scss +++ b/public/sass/components/_gf-form.scss @@ -79,6 +79,10 @@ $gf-form-margin: 0.25rem; } } +.gf-form-textarea { + max-width: 650px; +} + .gf-form-input { display: block; width: 100%; @@ -249,6 +253,10 @@ $gf-form-margin: 0.25rem; &--right-normal { float: right; } + + &--header { + margin-bottom: $gf-form-margin + } } select.gf-form-input ~ .gf-form-help-icon {