AuthN: cleanup logs (#63652)

* AuthN: clean up logs
Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>

pkg/services/authn/clients/anonymous.go

@@ -47,7 +47,7 @@ func (a *Anonymous) Authenticate(ctx context.Context, r *authn.Request) (*authn.
 			}
 		}()
 		if err := a.anonSessionService.TagSession(context.Background(), r.HTTPRequest); err != nil {
-			a.log.Warn("Failed to tag anonymous session", "error", err)
+			a.log.Warn("failed to tag anonymous session", "error", err)
 		}
 	}()
 

pkg/services/authn/clients/jwt.go

@@ -53,13 +53,13 @@ func (s *JWT) Authenticate(ctx context.Context, r *authn.Request) (*authn.Identi
 
 	claims, err := s.jwtService.Verify(ctx, jwtToken)
 	if err != nil {
-		s.log.Debug("Failed to verify JWT", "error", err)
+		s.log.FromContext(ctx).Debug("Failed to verify JWT", "error", err)
 		return nil, errJWTInvalid.Errorf("failed to verify JWT: %w", err)
 	}
 
 	sub, _ := claims["sub"].(string)
 	if sub == "" {
-		s.log.Warn("Got a JWT without the mandatory 'sub' claim", "error", err)
+		s.log.FromContext(ctx).Warn("Got a JWT without the mandatory 'sub' claim", "error", err)
 		return nil, errJWTMissingClaim.Errorf("missing mandatory 'sub' claim in JWT")
 	}
 
@@ -112,7 +112,7 @@ func (s *JWT) Authenticate(ctx context.Context, r *authn.Request) (*authn.Identi
 	id.IsGrafanaAdmin = isGrafanaAdmin
 
 	if id.Login == "" && id.Email == "" {
-		s.log.Debug("Failed to get an authentication claim from JWT",
+		s.log.FromContext(ctx).Debug("Failed to get an authentication claim from JWT",
 			"login", id.Login, "email", id.Email)
 		return nil, errJWTMissingClaim.Errorf("missing login and email claim in JWT")
 	}

pkg/services/authn/clients/password.go

@@ -51,9 +51,9 @@ func (c *Password) AuthenticatePassword(ctx context.Context, r *authn.Request, u
 	for _, pwClient := range c.clients {
 		identity, clientErr := pwClient.AuthenticatePassword(ctx, r, username, password)
 		clientErrs = multierror.Append(clientErrs, clientErr)
-		// for invalid password or if the identity is not found by a client continue to next one
+		// we always try next client on any error
 		if clientErr != nil {
-			c.log.Warn("failed to authenticate password identity", "client", pwClient, "error", clientErr)
+			c.log.FromContext(ctx).Debug("Failed to authenticate password identity", "client", pwClient, "error", clientErr)
 			continue
 		}
 

pkg/services/authn/clients/proxy.go

@@ -89,13 +89,13 @@ func (c *Proxy) Authenticate(ctx context.Context, r *authn.Request) (*authn.Iden
 			})
 
 			if err != nil {
-				c.log.Warn("could not resolved cached user", "error", err, "userId", entry.(int64))
+				c.log.FromContext(ctx).Warn("Could not resolved cached user", "error", err, "userId", entry.(int64))
 			}
 
 			// if we for some reason cannot find the user we proceed with the normal flow, authenticate with ProxyClient
 			// and perform syncs
 			if usr != nil {
-				c.log.Debug("user was loaded from cache, skip syncs", "userId", usr.UserID)
+				c.log.FromContext(ctx).Debug("User was loaded from cache, skip syncs", "userId", usr.UserID)
 				return authn.IdentityFromSignedInUser(authn.NamespacedID(authn.NamespaceUser, usr.UserID), usr, authn.ClientParams{}), nil
 			}
 		}
@@ -132,9 +132,9 @@ func (c *Proxy) Hook(ctx context.Context, identity *authn.Identity, r *authn.Req
 		return nil
 	}
 
-	c.log.Debug("cache proxy user", "userId", id)
+	c.log.FromContext(ctx).Debug("Cache proxy user", "userId", id)
 	if err := c.cache.Set(ctx, identity.ClientParams.CacheAuthProxyKey, id, time.Duration(c.cfg.AuthProxySyncTTL)*time.Minute); err != nil {
-		c.log.Warn("failed to cache proxy user", "error", err, "userId", id)
+		c.log.FromContext(ctx).Warn("Failed to cache proxy user", "error", err, "userId", id)
 	}
 
 	return nil

pkg/services/authn/clients/render.go

@@ -13,7 +13,7 @@ import (
 )
 
 var (
-	ErrInvalidRenderKey = errutil.NewBase(errutil.StatusUnauthorized, "render-auth.invalid-key", errutil.WithPublicMessage("Invalid Render Key"))
+	errInvalidRenderKey = errutil.NewBase(errutil.StatusUnauthorized, "render-auth.invalid-key", errutil.WithPublicMessage("Invalid Render Key"))
 )
 
 const (
@@ -39,7 +39,7 @@ func (c *Render) Authenticate(ctx context.Context, r *authn.Request) (*authn.Ide
 	key := getRenderKey(r)
 	renderUsr, ok := c.renderService.GetRenderUser(ctx, key)
 	if !ok {
-		return nil, ErrInvalidRenderKey.Errorf("found no render user for key: %s", key)
+		return nil, errInvalidRenderKey.Errorf("found no render user for key: %s", key)
 	}
 
 	var identity *authn.Identity

pkg/services/authn/clients/render_test.go

@@ -84,7 +84,7 @@ func TestRender_Authenticate(t *testing.T) {
 					Header: map[string][]string{"Cookie": {"renderKey=123"}},
 				},
 			},
-			expectedErr: ErrInvalidRenderKey,
+			expectedErr: errInvalidRenderKey,
 		},
 	}
 

pkg/services/authn/clients/session.go

@@ -54,14 +54,15 @@ func (s *Session) Authenticate(ctx context.Context, r *authn.Request) (*authn.Id
 
 	token, err := s.sessionService.LookupToken(ctx, rawSessionToken)
 	if err != nil {
-		s.log.Warn("failed to look up session from cookie", "error", err)
+		s.log.FromContext(ctx).Warn("Failed to look up session from cookie", "error", err)
 		return nil, err
 	}
 
-	signedInUser, err := s.userService.GetSignedInUserWithCacheCtx(ctx,
-		&user.GetSignedInUserQuery{UserID: token.UserId, OrgID: r.OrgID})
+	signedInUser, err := s.userService.GetSignedInUserWithCacheCtx(
+		ctx, &user.GetSignedInUserQuery{UserID: token.UserId, OrgID: r.OrgID},
+	)
 	if err != nil {
-		s.log.Error("failed to get user with id", "userId", token.UserId, "error", err)
+		s.log.FromContext(ctx).Error("Failed to get user with id", "userId", token.UserId, "error", err)
 		return nil, err
 	}