Plugins: Refactor forward of cookies, OAuth token and header modifications by introducing client middlewares (#58132)

Adding support for backend plugin client middlewares. This allows headers in outgoing 
backend plugin and HTTP requests to be modified using client middlewares.

The following client middlewares added:
Forward cookies: Will forward incoming HTTP request Cookies to outgoing plugins.Client 
and HTTP requests if the datasource has enabled forwarding of cookies (keepCookies).
Forward OAuth token: Will set OAuth token headers on outgoing plugins.Client and HTTP 
requests if the datasource has enabled Forward OAuth Identity (oauthPassThru).
Clear auth headers: Will clear any outgoing HTTP headers that was part of the incoming 
HTTP request and used when authenticating to Grafana.
The current suggested way to register client middlewares is to have a separate package, 
pluginsintegration, responsible for bootstrap/instantiate the backend plugin client with 
middlewares and/or longer term bootstrap/instantiate plugin management. 

Fixes #54135
Related to #47734
Related to #57870
Related to #41623
Related to #57065

pkg/services/pluginsintegration/clientmiddleware/clear_auth_headers_middleware.go

@@ -0,0 +1,87 @@
+package clientmiddleware
+
+import (
+	"context"
+
+	"github.com/grafana/grafana-plugin-sdk-go/backend"
+	sdkhttpclient "github.com/grafana/grafana-plugin-sdk-go/backend/httpclient"
+	"github.com/grafana/grafana/pkg/infra/httpclient/httpclientprovider"
+	"github.com/grafana/grafana/pkg/plugins"
+	"github.com/grafana/grafana/pkg/services/contexthandler"
+)
+
+// NewClearAuthHeadersMiddleware creates a new plugins.ClientMiddleware
+// that will clear any outgoing HTTP headers that was part of the incoming
+// HTTP request and used when authenticating to Grafana.
+func NewClearAuthHeadersMiddleware() plugins.ClientMiddleware {
+	return plugins.ClientMiddlewareFunc(func(next plugins.Client) plugins.Client {
+		return &ClearAuthHeadersMiddleware{
+			next: next,
+		}
+	})
+}
+
+type ClearAuthHeadersMiddleware struct {
+	next plugins.Client
+}
+
+func (m *ClearAuthHeadersMiddleware) clearHeaders(ctx context.Context, pCtx backend.PluginContext, req interface{}) context.Context {
+	reqCtx := contexthandler.FromContext(ctx)
+	// if no HTTP request context skip middleware
+	if req == nil || reqCtx == nil || reqCtx.Req == nil || reqCtx.SignedInUser == nil {
+		return ctx
+	}
+
+	list := contexthandler.AuthHTTPHeaderListFromContext(ctx)
+	if list != nil {
+		ctx = sdkhttpclient.WithContextualMiddleware(ctx, httpclientprovider.DeleteHeadersMiddleware(list.Items...))
+	}
+
+	return ctx
+}
+
+func (m *ClearAuthHeadersMiddleware) QueryData(ctx context.Context, req *backend.QueryDataRequest) (*backend.QueryDataResponse, error) {
+	if req == nil {
+		return m.next.QueryData(ctx, req)
+	}
+
+	ctx = m.clearHeaders(ctx, req.PluginContext, req)
+
+	return m.next.QueryData(ctx, req)
+}
+
+func (m *ClearAuthHeadersMiddleware) CallResource(ctx context.Context, req *backend.CallResourceRequest, sender backend.CallResourceResponseSender) error {
+	if req == nil {
+		return m.next.CallResource(ctx, req, sender)
+	}
+
+	ctx = m.clearHeaders(ctx, req.PluginContext, req)
+
+	return m.next.CallResource(ctx, req, sender)
+}
+
+func (m *ClearAuthHeadersMiddleware) CheckHealth(ctx context.Context, req *backend.CheckHealthRequest) (*backend.CheckHealthResult, error) {
+	if req == nil {
+		return m.next.CheckHealth(ctx, req)
+	}
+
+	ctx = m.clearHeaders(ctx, req.PluginContext, req)
+
+	return m.next.CheckHealth(ctx, req)
+}
+
+func (m *ClearAuthHeadersMiddleware) CollectMetrics(ctx context.Context, req *backend.CollectMetricsRequest) (*backend.CollectMetricsResult, error) {
+	return m.next.CollectMetrics(ctx, req)
+}
+
+func (m *ClearAuthHeadersMiddleware) SubscribeStream(ctx context.Context, req *backend.SubscribeStreamRequest) (*backend.SubscribeStreamResponse, error) {
+	return m.next.SubscribeStream(ctx, req)
+}
+
+func (m *ClearAuthHeadersMiddleware) PublishStream(ctx context.Context, req *backend.PublishStreamRequest) (*backend.PublishStreamResponse, error) {
+	return m.next.PublishStream(ctx, req)
+}
+
+func (m *ClearAuthHeadersMiddleware) RunStream(ctx context.Context, req *backend.RunStreamRequest, sender *backend.StreamSender) error {
+	return m.next.RunStream(ctx, req, sender)
+}

pkg/services/pluginsintegration/clientmiddleware/clear_auth_headers_middleware_test.go

@@ -0,0 +1,310 @@
+package clientmiddleware
+
+import (
+	"bytes"
+	"io"
+	"net/http"
+	"testing"
+
+	"github.com/grafana/grafana-plugin-sdk-go/backend"
+	"github.com/grafana/grafana-plugin-sdk-go/backend/httpclient"
+	"github.com/grafana/grafana/pkg/infra/httpclient/httpclientprovider"
+	"github.com/grafana/grafana/pkg/plugins/manager/client/clienttest"
+	"github.com/grafana/grafana/pkg/services/contexthandler"
+	"github.com/grafana/grafana/pkg/services/user"
+	"github.com/stretchr/testify/require"
+)
+
+func TestClearAuthHeadersMiddleware(t *testing.T) {
+	const otherHeader = "test"
+
+	t.Run("When no auth headers in reqContext", func(t *testing.T) {
+		req, err := http.NewRequest(http.MethodGet, "/some/thing", nil)
+		require.NoError(t, err)
+
+		req.Header.Set(otherHeader, "test")
+
+		t.Run("And requests are for a datasource", func(t *testing.T) {
+			cdt := clienttest.NewClientDecoratorTest(t,
+				clienttest.WithReqContext(req, &user.SignedInUser{}),
+				clienttest.WithMiddlewares(NewClearAuthHeadersMiddleware()),
+			)
+
+			pluginCtx := backend.PluginContext{
+				DataSourceInstanceSettings: &backend.DataSourceInstanceSettings{},
+			}
+
+			t.Run("Should not attach delete headers middleware when calling QueryData", func(t *testing.T) {
+				_, err = cdt.Decorator.QueryData(req.Context(), &backend.QueryDataRequest{
+					PluginContext: pluginCtx,
+					Headers:       map[string]string{otherHeader: "test"},
+				})
+				require.NoError(t, err)
+				require.NotNil(t, cdt.QueryDataReq)
+				require.Len(t, cdt.QueryDataReq.Headers, 1)
+
+				middlewares := httpclient.ContextualMiddlewareFromContext(cdt.QueryDataCtx)
+				require.Len(t, middlewares, 0)
+			})
+
+			t.Run("Should not attach delete headers middleware when calling CallResource", func(t *testing.T) {
+				err = cdt.Decorator.CallResource(req.Context(), &backend.CallResourceRequest{
+					PluginContext: pluginCtx,
+					Headers:       map[string][]string{otherHeader: {"test"}},
+				}, nopCallResourceSender)
+				require.NoError(t, err)
+				require.NotNil(t, cdt.CallResourceReq)
+				require.Len(t, cdt.CallResourceReq.Headers, 1)
+
+				middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CallResourceCtx)
+				require.Len(t, middlewares, 0)
+			})
+
+			t.Run("Should not attach delete headers middleware when calling CheckHealth", func(t *testing.T) {
+				_, err = cdt.Decorator.CheckHealth(req.Context(), &backend.CheckHealthRequest{
+					PluginContext: pluginCtx,
+					Headers:       map[string]string{otherHeader: "test"},
+				})
+				require.NoError(t, err)
+				require.NotNil(t, cdt.CheckHealthReq)
+				require.Len(t, cdt.CheckHealthReq.Headers, 1)
+
+				middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CheckHealthCtx)
+				require.Len(t, middlewares, 0)
+			})
+		})
+
+		t.Run("And requests are for an app", func(t *testing.T) {
+			cdt := clienttest.NewClientDecoratorTest(t,
+				clienttest.WithReqContext(req, &user.SignedInUser{}),
+				clienttest.WithMiddlewares(NewClearAuthHeadersMiddleware()),
+			)
+
+			pluginCtx := backend.PluginContext{
+				AppInstanceSettings: &backend.AppInstanceSettings{},
+			}
+
+			t.Run("Should not attach delete headers middleware when calling QueryData", func(t *testing.T) {
+				_, err = cdt.Decorator.QueryData(req.Context(), &backend.QueryDataRequest{
+					PluginContext: pluginCtx,
+					Headers:       map[string]string{otherHeader: "test"},
+				})
+				require.NoError(t, err)
+				require.NotNil(t, cdt.QueryDataReq)
+				require.Len(t, cdt.QueryDataReq.Headers, 1)
+
+				middlewares := httpclient.ContextualMiddlewareFromContext(cdt.QueryDataCtx)
+				require.Len(t, middlewares, 0)
+			})
+
+			t.Run("Should not attach delete headers middleware when calling CallResource", func(t *testing.T) {
+				err = cdt.Decorator.CallResource(req.Context(), &backend.CallResourceRequest{
+					PluginContext: pluginCtx,
+					Headers:       map[string][]string{otherHeader: {"test"}},
+				}, nopCallResourceSender)
+				require.NoError(t, err)
+				require.NotNil(t, cdt.CallResourceReq)
+				require.Len(t, cdt.CallResourceReq.Headers, 1)
+
+				middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CallResourceCtx)
+				require.Len(t, middlewares, 0)
+			})
+
+			t.Run("Should not attach delete headers middleware when calling CheckHealth", func(t *testing.T) {
+				_, err = cdt.Decorator.CheckHealth(req.Context(), &backend.CheckHealthRequest{
+					PluginContext: pluginCtx,
+					Headers:       map[string]string{otherHeader: "test"},
+				})
+				require.NoError(t, err)
+				require.NotNil(t, cdt.CheckHealthReq)
+				require.Len(t, cdt.CheckHealthReq.Headers, 1)
+
+				middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CheckHealthCtx)
+				require.Len(t, middlewares, 0)
+			})
+		})
+	})
+
+	t.Run("When auth headers in reqContext", func(t *testing.T) {
+		req, err := http.NewRequest(http.MethodGet, "/some/thing", nil)
+		require.NoError(t, err)
+
+		t.Run("And requests are for a datasource", func(t *testing.T) {
+			cdt := clienttest.NewClientDecoratorTest(t,
+				clienttest.WithReqContext(req, &user.SignedInUser{}),
+				clienttest.WithMiddlewares(NewClearAuthHeadersMiddleware()),
+			)
+
+			const customHeader = "X-Custom"
+			req.Header.Set(customHeader, "val")
+			ctx := contexthandler.WithAuthHTTPHeader(req.Context(), customHeader)
+			req = req.WithContext(ctx)
+
+			const otherHeader = "X-Other"
+			req.Header.Set(otherHeader, "test")
+
+			pluginCtx := backend.PluginContext{
+				DataSourceInstanceSettings: &backend.DataSourceInstanceSettings{},
+			}
+
+			t.Run("Should attach delete headers middleware when calling QueryData", func(t *testing.T) {
+				_, err = cdt.Decorator.QueryData(req.Context(), &backend.QueryDataRequest{
+					PluginContext: pluginCtx,
+					Headers:       map[string]string{otherHeader: "test"},
+				})
+				require.NoError(t, err)
+				require.NotNil(t, cdt.QueryDataReq)
+				require.Len(t, cdt.QueryDataReq.Headers, 1)
+
+				middlewares := httpclient.ContextualMiddlewareFromContext(cdt.QueryDataCtx)
+				require.Len(t, middlewares, 1)
+				require.Equal(t, httpclientprovider.DeleteHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName())
+
+				reqClone := req.Clone(req.Context())
+				res, err := middlewares[0].CreateMiddleware(httpclient.Options{}, finalRoundTripper).RoundTrip(reqClone)
+				require.NoError(t, err)
+				require.NoError(t, res.Body.Close())
+				require.Len(t, reqClone.Header, 1)
+				require.Empty(t, reqClone.Header[customHeader])
+				require.Equal(t, "test", reqClone.Header.Get(otherHeader))
+			})
+
+			t.Run("Should attach delete headers middleware when calling CallResource", func(t *testing.T) {
+				err = cdt.Decorator.CallResource(req.Context(), &backend.CallResourceRequest{
+					PluginContext: pluginCtx,
+					Headers:       map[string][]string{otherHeader: {"test"}},
+				}, nopCallResourceSender)
+				require.NoError(t, err)
+				require.NotNil(t, cdt.CallResourceReq)
+				require.Len(t, cdt.CallResourceReq.Headers, 1)
+
+				middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CallResourceCtx)
+				require.Len(t, middlewares, 1)
+				require.Equal(t, httpclientprovider.DeleteHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName())
+
+				reqClone := req.Clone(req.Context())
+				res, err := middlewares[0].CreateMiddleware(httpclient.Options{}, finalRoundTripper).RoundTrip(reqClone)
+				require.NoError(t, err)
+				require.NoError(t, res.Body.Close())
+				require.Len(t, reqClone.Header, 1)
+				require.Empty(t, reqClone.Header[customHeader])
+				require.Equal(t, "test", reqClone.Header.Get(otherHeader))
+			})
+
+			t.Run("Should attach delete headers middleware when calling CheckHealth", func(t *testing.T) {
+				_, err = cdt.Decorator.CheckHealth(req.Context(), &backend.CheckHealthRequest{
+					PluginContext: pluginCtx,
+					Headers:       map[string]string{otherHeader: "test"},
+				})
+				require.NoError(t, err)
+				require.NotNil(t, cdt.CheckHealthReq)
+				require.Len(t, cdt.CheckHealthReq.Headers, 1)
+
+				middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CheckHealthCtx)
+				require.Len(t, middlewares, 1)
+				require.Equal(t, httpclientprovider.DeleteHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName())
+
+				reqClone := req.Clone(req.Context())
+				res, err := middlewares[0].CreateMiddleware(httpclient.Options{}, finalRoundTripper).RoundTrip(reqClone)
+				require.NoError(t, err)
+				require.NoError(t, res.Body.Close())
+				require.Len(t, reqClone.Header, 1)
+				require.Empty(t, reqClone.Header[customHeader])
+				require.Equal(t, "test", reqClone.Header.Get(otherHeader))
+			})
+		})
+
+		t.Run("And requests are for an app", func(t *testing.T) {
+			cdt := clienttest.NewClientDecoratorTest(t,
+				clienttest.WithReqContext(req, &user.SignedInUser{}),
+				clienttest.WithMiddlewares(NewClearAuthHeadersMiddleware()),
+			)
+
+			const customHeader = "X-Custom"
+			req.Header.Set(customHeader, "val")
+			ctx := contexthandler.WithAuthHTTPHeader(req.Context(), customHeader)
+			req = req.WithContext(ctx)
+
+			const otherHeader = "X-Other"
+			req.Header.Set(otherHeader, "test")
+
+			pluginCtx := backend.PluginContext{
+				AppInstanceSettings: &backend.AppInstanceSettings{},
+			}
+
+			t.Run("Should attach delete headers middleware when calling QueryData", func(t *testing.T) {
+				_, err = cdt.Decorator.QueryData(req.Context(), &backend.QueryDataRequest{
+					PluginContext: pluginCtx,
+					Headers:       map[string]string{otherHeader: "test"},
+				})
+				require.NoError(t, err)
+				require.NotNil(t, cdt.QueryDataReq)
+				require.Len(t, cdt.QueryDataReq.Headers, 1)
+
+				middlewares := httpclient.ContextualMiddlewareFromContext(cdt.QueryDataCtx)
+				require.Len(t, middlewares, 1)
+				require.Equal(t, httpclientprovider.DeleteHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName())
+
+				reqClone := req.Clone(req.Context())
+				res, err := middlewares[0].CreateMiddleware(httpclient.Options{}, finalRoundTripper).RoundTrip(reqClone)
+				require.NoError(t, err)
+				require.NoError(t, res.Body.Close())
+				require.Len(t, reqClone.Header, 1)
+				require.Empty(t, reqClone.Header[customHeader])
+				require.Equal(t, "test", reqClone.Header.Get(otherHeader))
+			})
+
+			t.Run("Should attach delete headers middleware when calling CallResource", func(t *testing.T) {
+				err = cdt.Decorator.CallResource(req.Context(), &backend.CallResourceRequest{
+					PluginContext: pluginCtx,
+					Headers:       map[string][]string{otherHeader: {"test"}},
+				}, nopCallResourceSender)
+				require.NoError(t, err)
+				require.NotNil(t, cdt.CallResourceReq)
+				require.Len(t, cdt.CallResourceReq.Headers, 1)
+
+				middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CallResourceCtx)
+				require.Len(t, middlewares, 1)
+				require.Equal(t, httpclientprovider.DeleteHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName())
+
+				reqClone := req.Clone(req.Context())
+				res, err := middlewares[0].CreateMiddleware(httpclient.Options{}, finalRoundTripper).RoundTrip(reqClone)
+				require.NoError(t, err)
+				require.NoError(t, res.Body.Close())
+				require.Len(t, reqClone.Header, 1)
+				require.Empty(t, reqClone.Header[customHeader])
+				require.Equal(t, "test", reqClone.Header.Get(otherHeader))
+			})
+
+			t.Run("Should attach delete headers middleware when calling CheckHealth", func(t *testing.T) {
+				_, err = cdt.Decorator.CheckHealth(req.Context(), &backend.CheckHealthRequest{
+					PluginContext: pluginCtx,
+					Headers:       map[string]string{otherHeader: "test"},
+				})
+				require.NoError(t, err)
+				require.NotNil(t, cdt.CheckHealthReq)
+				require.Len(t, cdt.CheckHealthReq.Headers, 1)
+
+				middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CheckHealthCtx)
+				require.Len(t, middlewares, 1)
+				require.Equal(t, httpclientprovider.DeleteHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName())
+
+				reqClone := req.Clone(req.Context())
+				res, err := middlewares[0].CreateMiddleware(httpclient.Options{}, finalRoundTripper).RoundTrip(reqClone)
+				require.NoError(t, err)
+				require.NoError(t, res.Body.Close())
+				require.Len(t, reqClone.Header, 1)
+				require.Empty(t, reqClone.Header[customHeader])
+				require.Equal(t, "test", reqClone.Header.Get(otherHeader))
+			})
+		})
+	})
+}
+
+var finalRoundTripper = httpclient.RoundTripperFunc(func(req *http.Request) (*http.Response, error) {
+	return &http.Response{
+		StatusCode: http.StatusOK,
+		Request:    req,
+		Body:       io.NopCloser(bytes.NewBufferString("")),
+	}, nil
+})

pkg/services/pluginsintegration/clientmiddleware/cookies_middleware.go

@@ -0,0 +1,126 @@
+package clientmiddleware
+
+import (
+	"context"
+
+	"github.com/grafana/grafana-plugin-sdk-go/backend"
+	"github.com/grafana/grafana-plugin-sdk-go/backend/httpclient"
+	"github.com/grafana/grafana/pkg/components/simplejson"
+	"github.com/grafana/grafana/pkg/infra/httpclient/httpclientprovider"
+	"github.com/grafana/grafana/pkg/plugins"
+	"github.com/grafana/grafana/pkg/services/contexthandler"
+	"github.com/grafana/grafana/pkg/services/datasources"
+	"github.com/grafana/grafana/pkg/util/proxyutil"
+)
+
+const cookieHeaderName = "Cookie"
+
+// NewCookiesMiddleware creates a new plugins.ClientMiddleware that will
+// forward incoming HTTP request Cookies to outgoing plugins.Client and
+// HTTP requests if the datasource has enabled forwarding of cookies (keepCookies).
+func NewCookiesMiddleware(skipCookiesNames []string) plugins.ClientMiddleware {
+	return plugins.ClientMiddlewareFunc(func(next plugins.Client) plugins.Client {
+		return &CookiesMiddleware{
+			next:             next,
+			skipCookiesNames: skipCookiesNames,
+		}
+	})
+}
+
+type CookiesMiddleware struct {
+	next             plugins.Client
+	skipCookiesNames []string
+}
+
+func (m *CookiesMiddleware) applyCookies(ctx context.Context, pCtx backend.PluginContext, req interface{}) (context.Context, error) {
+	reqCtx := contexthandler.FromContext(ctx)
+	// if request not for a datasource or no HTTP request context skip middleware
+	if req == nil || pCtx.DataSourceInstanceSettings == nil || reqCtx == nil || reqCtx.Req == nil {
+		return ctx, nil
+	}
+
+	settings := pCtx.DataSourceInstanceSettings
+	jsonDataBytes, err := simplejson.NewJson(settings.JSONData)
+	if err != nil {
+		return ctx, err
+	}
+
+	ds := &datasources.DataSource{
+		Id:       settings.ID,
+		OrgId:    pCtx.OrgID,
+		JsonData: jsonDataBytes,
+		Updated:  settings.Updated,
+	}
+
+	proxyutil.ClearCookieHeader(reqCtx.Req, ds.AllowedCookies(), m.skipCookiesNames)
+
+	if cookieStr := reqCtx.Req.Header.Get(cookieHeaderName); cookieStr != "" {
+		switch t := req.(type) {
+		case *backend.QueryDataRequest:
+			t.Headers[cookieHeaderName] = cookieStr
+		case *backend.CheckHealthRequest:
+			t.Headers[cookieHeaderName] = cookieStr
+		case *backend.CallResourceRequest:
+			t.Headers[cookieHeaderName] = []string{cookieStr}
+		}
+	}
+
+	ctx = httpclient.WithContextualMiddleware(ctx, httpclientprovider.ForwardedCookiesMiddleware(reqCtx.Req.Cookies(), ds.AllowedCookies(), m.skipCookiesNames))
+
+	return ctx, nil
+}
+
+func (m *CookiesMiddleware) QueryData(ctx context.Context, req *backend.QueryDataRequest) (*backend.QueryDataResponse, error) {
+	if req == nil {
+		return m.next.QueryData(ctx, req)
+	}
+
+	newCtx, err := m.applyCookies(ctx, req.PluginContext, req)
+	if err != nil {
+		return nil, err
+	}
+
+	return m.next.QueryData(newCtx, req)
+}
+
+func (m *CookiesMiddleware) CallResource(ctx context.Context, req *backend.CallResourceRequest, sender backend.CallResourceResponseSender) error {
+	if req == nil {
+		return m.next.CallResource(ctx, req, sender)
+	}
+
+	newCtx, err := m.applyCookies(ctx, req.PluginContext, req)
+	if err != nil {
+		return err
+	}
+
+	return m.next.CallResource(newCtx, req, sender)
+}
+
+func (m *CookiesMiddleware) CheckHealth(ctx context.Context, req *backend.CheckHealthRequest) (*backend.CheckHealthResult, error) {
+	if req == nil {
+		return m.next.CheckHealth(ctx, req)
+	}
+
+	newCtx, err := m.applyCookies(ctx, req.PluginContext, req)
+	if err != nil {
+		return nil, err
+	}
+
+	return m.next.CheckHealth(newCtx, req)
+}
+
+func (m *CookiesMiddleware) CollectMetrics(ctx context.Context, req *backend.CollectMetricsRequest) (*backend.CollectMetricsResult, error) {
+	return m.next.CollectMetrics(ctx, req)
+}
+
+func (m *CookiesMiddleware) SubscribeStream(ctx context.Context, req *backend.SubscribeStreamRequest) (*backend.SubscribeStreamResponse, error) {
+	return m.next.SubscribeStream(ctx, req)
+}
+
+func (m *CookiesMiddleware) PublishStream(ctx context.Context, req *backend.PublishStreamRequest) (*backend.PublishStreamResponse, error) {
+	return m.next.PublishStream(ctx, req)
+}
+
+func (m *CookiesMiddleware) RunStream(ctx context.Context, req *backend.RunStreamRequest, sender *backend.StreamSender) error {
+	return m.next.RunStream(ctx, req, sender)
+}

pkg/services/pluginsintegration/clientmiddleware/cookies_middleware_test.go

@@ -0,0 +1,223 @@
+package clientmiddleware
+
+import (
+	"encoding/json"
+	"net/http"
+	"testing"
+
+	"github.com/grafana/grafana-plugin-sdk-go/backend"
+	"github.com/grafana/grafana-plugin-sdk-go/backend/httpclient"
+	"github.com/grafana/grafana/pkg/infra/httpclient/httpclientprovider"
+	"github.com/grafana/grafana/pkg/plugins/manager/client/clienttest"
+	"github.com/grafana/grafana/pkg/services/user"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCookiesMiddleware(t *testing.T) {
+	const otherHeader = "test"
+
+	t.Run("When keepCookies not configured for a datasource", func(t *testing.T) {
+		req, err := http.NewRequest(http.MethodGet, "/some/thing", nil)
+		require.NoError(t, err)
+		req.AddCookie(&http.Cookie{
+			Name: "cookie1",
+		})
+		req.AddCookie(&http.Cookie{
+			Name: "cookie2",
+		})
+		req.AddCookie(&http.Cookie{
+			Name: "cookie3",
+		})
+		req.Header.Set(otherHeader, "test")
+
+		cdt := clienttest.NewClientDecoratorTest(t,
+			clienttest.WithReqContext(req, &user.SignedInUser{}),
+			clienttest.WithMiddlewares(NewCookiesMiddleware([]string{"grafana_session"})),
+		)
+
+		jsonDataMap := map[string]interface{}{}
+		jsonDataBytes, err := json.Marshal(&jsonDataMap)
+		require.NoError(t, err)
+
+		pluginCtx := backend.PluginContext{
+			DataSourceInstanceSettings: &backend.DataSourceInstanceSettings{
+				JSONData: jsonDataBytes,
+			},
+		}
+
+		t.Run("Should not forward cookies when calling QueryData", func(t *testing.T) {
+			_, err = cdt.Decorator.QueryData(req.Context(), &backend.QueryDataRequest{
+				PluginContext: pluginCtx,
+				Headers:       map[string]string{otherHeader: "test"},
+			})
+			require.NoError(t, err)
+			require.NotNil(t, cdt.QueryDataReq)
+			require.Len(t, cdt.QueryDataReq.Headers, 1)
+			require.Equal(t, "test", cdt.QueryDataReq.Headers[otherHeader])
+
+			middlewares := httpclient.ContextualMiddlewareFromContext(cdt.QueryDataCtx)
+			require.Len(t, middlewares, 1)
+			require.Equal(t, httpclientprovider.ForwardedCookiesMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName())
+
+			reqClone := req.Clone(req.Context())
+			res, err := middlewares[0].CreateMiddleware(httpclient.Options{}, finalRoundTripper).RoundTrip(reqClone)
+			require.NoError(t, err)
+			require.NoError(t, res.Body.Close())
+			require.Len(t, reqClone.Header, 1)
+			require.Equal(t, "test", reqClone.Header.Get(otherHeader))
+		})
+
+		t.Run("Should not forward cookies when calling CallResource", func(t *testing.T) {
+			err = cdt.Decorator.CallResource(req.Context(), &backend.CallResourceRequest{
+				PluginContext: pluginCtx,
+				Headers:       map[string][]string{otherHeader: {"test"}},
+			}, nopCallResourceSender)
+			require.NoError(t, err)
+			require.NotNil(t, cdt.CallResourceReq)
+			require.Len(t, cdt.CallResourceReq.Headers, 1)
+			require.Equal(t, "test", cdt.CallResourceReq.Headers[otherHeader][0])
+
+			middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CallResourceCtx)
+			require.Len(t, middlewares, 1)
+			require.Equal(t, httpclientprovider.ForwardedCookiesMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName())
+
+			reqClone := req.Clone(req.Context())
+			res, err := middlewares[0].CreateMiddleware(httpclient.Options{}, finalRoundTripper).RoundTrip(reqClone)
+			require.NoError(t, err)
+			require.NoError(t, res.Body.Close())
+			require.Len(t, reqClone.Header, 1)
+			require.Equal(t, "test", reqClone.Header.Get(otherHeader))
+		})
+
+		t.Run("Should not forward cookies when calling CheckHealth", func(t *testing.T) {
+			_, err = cdt.Decorator.CheckHealth(req.Context(), &backend.CheckHealthRequest{
+				PluginContext: pluginCtx,
+				Headers:       map[string]string{otherHeader: "test"},
+			})
+			require.NoError(t, err)
+			require.NotNil(t, cdt.CheckHealthReq)
+			require.Len(t, cdt.CheckHealthReq.Headers, 1)
+			require.Equal(t, "test", cdt.CheckHealthReq.Headers[otherHeader])
+
+			middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CheckHealthCtx)
+			require.Len(t, middlewares, 1)
+			require.Equal(t, httpclientprovider.ForwardedCookiesMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName())
+
+			reqClone := req.Clone(req.Context())
+			res, err := middlewares[0].CreateMiddleware(httpclient.Options{}, finalRoundTripper).RoundTrip(reqClone)
+			require.NoError(t, err)
+			require.NoError(t, res.Body.Close())
+			require.Len(t, reqClone.Header, 1)
+			require.Equal(t, "test", reqClone.Header.Get(otherHeader))
+		})
+	})
+
+	t.Run("When keepCookies configured for a datasource", func(t *testing.T) {
+		req, err := http.NewRequest(http.MethodGet, "/some/thing", nil)
+		require.NoError(t, err)
+		req.AddCookie(&http.Cookie{
+			Name: "cookie1",
+		})
+		req.AddCookie(&http.Cookie{
+			Name: "cookie2",
+		})
+		req.AddCookie(&http.Cookie{
+			Name: "cookie3",
+		})
+		req.AddCookie(&http.Cookie{
+			Name: "grafana_session",
+		})
+
+		req.Header.Set(otherHeader, "test")
+
+		cdt := clienttest.NewClientDecoratorTest(t,
+			clienttest.WithReqContext(req, &user.SignedInUser{}),
+			clienttest.WithMiddlewares(NewCookiesMiddleware([]string{"grafana_session"})),
+		)
+
+		jsonDataMap := map[string]interface{}{
+			"keepCookies": []string{"cookie2", "grafana_session"},
+		}
+		jsonDataBytes, err := json.Marshal(&jsonDataMap)
+		require.NoError(t, err)
+
+		pluginCtx := backend.PluginContext{
+			DataSourceInstanceSettings: &backend.DataSourceInstanceSettings{
+				JSONData: jsonDataBytes,
+			},
+		}
+
+		t.Run("Should forward cookies when calling QueryData", func(t *testing.T) {
+			_, err = cdt.Decorator.QueryData(req.Context(), &backend.QueryDataRequest{
+				PluginContext: pluginCtx,
+				Headers:       map[string]string{otherHeader: "test"},
+			})
+			require.NoError(t, err)
+			require.NotNil(t, cdt.QueryDataReq)
+			require.Len(t, cdt.QueryDataReq.Headers, 2)
+			require.Equal(t, "test", cdt.QueryDataReq.Headers[otherHeader])
+			require.EqualValues(t, "cookie2=", cdt.QueryDataReq.Headers[cookieHeaderName])
+
+			middlewares := httpclient.ContextualMiddlewareFromContext(cdt.QueryDataCtx)
+			require.Len(t, middlewares, 1)
+			require.Equal(t, httpclientprovider.ForwardedCookiesMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName())
+
+			reqClone := req.Clone(req.Context())
+			res, err := middlewares[0].CreateMiddleware(httpclient.Options{}, finalRoundTripper).RoundTrip(reqClone)
+			require.NoError(t, err)
+			require.NoError(t, res.Body.Close())
+			require.Len(t, reqClone.Header, 2)
+			require.Equal(t, "test", reqClone.Header.Get(otherHeader))
+			require.Equal(t, "cookie2=", reqClone.Header.Get(cookieHeaderName))
+		})
+
+		t.Run("Should forward cookies when calling CallResource", func(t *testing.T) {
+			err = cdt.Decorator.CallResource(req.Context(), &backend.CallResourceRequest{
+				PluginContext: pluginCtx,
+				Headers:       map[string][]string{otherHeader: {"test"}},
+			}, nopCallResourceSender)
+			require.NoError(t, err)
+			require.NotNil(t, cdt.CallResourceReq)
+			require.Len(t, cdt.CallResourceReq.Headers, 2)
+			require.Equal(t, "test", cdt.CallResourceReq.Headers[otherHeader][0])
+			require.Len(t, cdt.CallResourceReq.Headers[cookieHeaderName], 1)
+			require.EqualValues(t, "cookie2=", cdt.CallResourceReq.Headers[cookieHeaderName][0])
+
+			middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CallResourceCtx)
+			require.Len(t, middlewares, 1)
+			require.Equal(t, httpclientprovider.ForwardedCookiesMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName())
+
+			reqClone := req.Clone(req.Context())
+			res, err := middlewares[0].CreateMiddleware(httpclient.Options{}, finalRoundTripper).RoundTrip(reqClone)
+			require.NoError(t, err)
+			require.NoError(t, res.Body.Close())
+			require.Len(t, reqClone.Header, 2)
+			require.Equal(t, "test", reqClone.Header.Get(otherHeader))
+			require.Equal(t, "cookie2=", reqClone.Header.Get(cookieHeaderName))
+		})
+
+		t.Run("Should forward cookies when calling CheckHealth", func(t *testing.T) {
+			_, err = cdt.Decorator.CheckHealth(req.Context(), &backend.CheckHealthRequest{
+				PluginContext: pluginCtx,
+				Headers:       map[string]string{otherHeader: "test"},
+			})
+			require.NoError(t, err)
+			require.NotNil(t, cdt.CheckHealthReq)
+			require.Len(t, cdt.CheckHealthReq.Headers, 2)
+			require.Equal(t, "test", cdt.CheckHealthReq.Headers[otherHeader])
+			require.EqualValues(t, "cookie2=", cdt.CheckHealthReq.Headers[cookieHeaderName])
+
+			middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CheckHealthCtx)
+			require.Len(t, middlewares, 1)
+			require.Equal(t, httpclientprovider.ForwardedCookiesMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName())
+
+			reqClone := req.Clone(req.Context())
+			res, err := middlewares[0].CreateMiddleware(httpclient.Options{}, finalRoundTripper).RoundTrip(reqClone)
+			require.NoError(t, err)
+			require.NoError(t, res.Body.Close())
+			require.Len(t, reqClone.Header, 2)
+			require.Equal(t, "test", reqClone.Header.Get(otherHeader))
+			require.Equal(t, "cookie2=", reqClone.Header.Get(cookieHeaderName))
+		})
+	})
+}

pkg/services/pluginsintegration/clientmiddleware/oauthtoken_middleware.go

@@ -0,0 +1,155 @@
+package clientmiddleware
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+
+	"github.com/grafana/grafana-plugin-sdk-go/backend"
+	"github.com/grafana/grafana-plugin-sdk-go/backend/httpclient"
+	"github.com/grafana/grafana/pkg/components/simplejson"
+	"github.com/grafana/grafana/pkg/infra/httpclient/httpclientprovider"
+	"github.com/grafana/grafana/pkg/plugins"
+	"github.com/grafana/grafana/pkg/services/contexthandler"
+	"github.com/grafana/grafana/pkg/services/datasources"
+	"github.com/grafana/grafana/pkg/services/oauthtoken"
+)
+
+// NewOAuthTokenMiddleware creates a new plugins.ClientMiddleware that will
+// set OAuth token headers on outgoing plugins.Client and HTTP requests if
+// the datasource has enabled Forward OAuth Identity (oauthPassThru).
+func NewOAuthTokenMiddleware(oAuthTokenService oauthtoken.OAuthTokenService) plugins.ClientMiddleware {
+	return plugins.ClientMiddlewareFunc(func(next plugins.Client) plugins.Client {
+		return &OAuthTokenMiddleware{
+			next:              next,
+			oAuthTokenService: oAuthTokenService,
+		}
+	})
+}
+
+const (
+	tokenHeaderName   = "Authorization"
+	idTokenHeaderName = "X-ID-Token"
+)
+
+type OAuthTokenMiddleware struct {
+	oAuthTokenService oauthtoken.OAuthTokenService
+	next              plugins.Client
+}
+
+func (m *OAuthTokenMiddleware) applyToken(ctx context.Context, pCtx backend.PluginContext, req interface{}) (context.Context, error) {
+	reqCtx := contexthandler.FromContext(ctx)
+	// if request not for a datasource or no HTTP request context skip middleware
+	if req == nil || pCtx.DataSourceInstanceSettings == nil || reqCtx == nil || reqCtx.Req == nil {
+		return ctx, nil
+	}
+
+	settings := pCtx.DataSourceInstanceSettings
+	jsonDataBytes, err := simplejson.NewJson(settings.JSONData)
+	if err != nil {
+		return ctx, err
+	}
+
+	ds := &datasources.DataSource{
+		Id:       settings.ID,
+		OrgId:    pCtx.OrgID,
+		JsonData: jsonDataBytes,
+		Updated:  settings.Updated,
+	}
+
+	if m.oAuthTokenService.IsOAuthPassThruEnabled(ds) {
+		if token := m.oAuthTokenService.GetCurrentOAuthToken(ctx, reqCtx.SignedInUser); token != nil {
+			authorizationHeader := fmt.Sprintf("%s %s", token.Type(), token.AccessToken)
+			idTokenHeader := ""
+
+			idToken, ok := token.Extra("id_token").(string)
+			if ok && idToken != "" {
+				idTokenHeader = idToken
+			}
+
+			switch t := req.(type) {
+			case *backend.QueryDataRequest:
+				t.Headers[tokenHeaderName] = authorizationHeader
+				if idTokenHeader != "" {
+					t.Headers[idTokenHeaderName] = idTokenHeader
+				}
+			case *backend.CheckHealthRequest:
+				t.Headers[tokenHeaderName] = authorizationHeader
+				if idTokenHeader != "" {
+					t.Headers[idTokenHeaderName] = idTokenHeader
+				}
+			case *backend.CallResourceRequest:
+				t.Headers[tokenHeaderName] = []string{authorizationHeader}
+				if idTokenHeader != "" {
+					t.Headers[idTokenHeaderName] = []string{idTokenHeader}
+				}
+			}
+
+			httpHeaders := http.Header{}
+			httpHeaders.Set(tokenHeaderName, authorizationHeader)
+
+			if idTokenHeader != "" {
+				httpHeaders.Set(idTokenHeaderName, idTokenHeader)
+			}
+
+			ctx = httpclient.WithContextualMiddleware(ctx, httpclientprovider.SetHeadersMiddleware(httpHeaders))
+		}
+	}
+
+	return ctx, nil
+}
+
+func (m *OAuthTokenMiddleware) QueryData(ctx context.Context, req *backend.QueryDataRequest) (*backend.QueryDataResponse, error) {
+	if req == nil {
+		return m.next.QueryData(ctx, req)
+	}
+
+	newCtx, err := m.applyToken(ctx, req.PluginContext, req)
+	if err != nil {
+		return nil, err
+	}
+
+	return m.next.QueryData(newCtx, req)
+}
+
+func (m *OAuthTokenMiddleware) CallResource(ctx context.Context, req *backend.CallResourceRequest, sender backend.CallResourceResponseSender) error {
+	if req == nil {
+		return m.next.CallResource(ctx, req, sender)
+	}
+
+	newCtx, err := m.applyToken(ctx, req.PluginContext, req)
+	if err != nil {
+		return err
+	}
+
+	return m.next.CallResource(newCtx, req, sender)
+}
+
+func (m *OAuthTokenMiddleware) CheckHealth(ctx context.Context, req *backend.CheckHealthRequest) (*backend.CheckHealthResult, error) {
+	if req == nil {
+		return m.next.CheckHealth(ctx, req)
+	}
+
+	newCtx, err := m.applyToken(ctx, req.PluginContext, req)
+	if err != nil {
+		return nil, err
+	}
+
+	return m.next.CheckHealth(newCtx, req)
+}
+
+func (m *OAuthTokenMiddleware) CollectMetrics(ctx context.Context, req *backend.CollectMetricsRequest) (*backend.CollectMetricsResult, error) {
+	return m.next.CollectMetrics(ctx, req)
+}
+
+func (m *OAuthTokenMiddleware) SubscribeStream(ctx context.Context, req *backend.SubscribeStreamRequest) (*backend.SubscribeStreamResponse, error) {
+	return m.next.SubscribeStream(ctx, req)
+}
+
+func (m *OAuthTokenMiddleware) PublishStream(ctx context.Context, req *backend.PublishStreamRequest) (*backend.PublishStreamResponse, error) {
+	return m.next.PublishStream(ctx, req)
+}
+
+func (m *OAuthTokenMiddleware) RunStream(ctx context.Context, req *backend.RunStreamRequest, sender *backend.StreamSender) error {
+	return m.next.RunStream(ctx, req, sender)
+}

pkg/services/pluginsintegration/clientmiddleware/oauthtoken_middleware_test.go

@@ -0,0 +1,197 @@
+package clientmiddleware
+
+import (
+	"encoding/json"
+	"net/http"
+	"testing"
+
+	"github.com/grafana/grafana-plugin-sdk-go/backend"
+	"github.com/grafana/grafana-plugin-sdk-go/backend/httpclient"
+	"github.com/grafana/grafana/pkg/infra/httpclient/httpclientprovider"
+	"github.com/grafana/grafana/pkg/plugins/manager/client/clienttest"
+	"github.com/grafana/grafana/pkg/services/oauthtoken/oauthtokentest"
+	"github.com/grafana/grafana/pkg/services/user"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/oauth2"
+)
+
+func TestOAuthTokenMiddleware(t *testing.T) {
+	const otherHeader = "test"
+
+	t.Run("When oauthPassThru not configured for a datasource", func(t *testing.T) {
+		req, err := http.NewRequest(http.MethodGet, "/some/thing", nil)
+		require.NoError(t, err)
+
+		req.Header.Set(otherHeader, "test")
+
+		oAuthTokenService := &oauthtokentest.Service{}
+		cdt := clienttest.NewClientDecoratorTest(t,
+			clienttest.WithReqContext(req, &user.SignedInUser{}),
+			clienttest.WithMiddlewares(NewOAuthTokenMiddleware(oAuthTokenService)),
+		)
+
+		jsonDataMap := map[string]interface{}{}
+		jsonDataBytes, err := json.Marshal(&jsonDataMap)
+		require.NoError(t, err)
+
+		pluginCtx := backend.PluginContext{
+			DataSourceInstanceSettings: &backend.DataSourceInstanceSettings{
+				JSONData: jsonDataBytes,
+			},
+		}
+
+		t.Run("Should not forward OAuth Identity when calling QueryData", func(t *testing.T) {
+			_, err = cdt.Decorator.QueryData(req.Context(), &backend.QueryDataRequest{
+				PluginContext: pluginCtx,
+				Headers:       map[string]string{otherHeader: "test"},
+			})
+			require.NoError(t, err)
+			require.NotNil(t, cdt.QueryDataReq)
+			require.Len(t, cdt.QueryDataReq.Headers, 1)
+			require.Equal(t, "test", cdt.QueryDataReq.Headers[otherHeader])
+
+			middlewares := httpclient.ContextualMiddlewareFromContext(cdt.QueryDataCtx)
+			require.Len(t, middlewares, 0)
+		})
+
+		t.Run("Should not forward OAuth Identity when calling CallResource", func(t *testing.T) {
+			err = cdt.Decorator.CallResource(req.Context(), &backend.CallResourceRequest{
+				PluginContext: pluginCtx,
+				Headers:       map[string][]string{otherHeader: {"test"}},
+			}, nopCallResourceSender)
+			require.NoError(t, err)
+			require.NotNil(t, cdt.CallResourceReq)
+			require.Len(t, cdt.CallResourceReq.Headers, 1)
+			require.Equal(t, "test", cdt.CallResourceReq.Headers[otherHeader][0])
+
+			middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CallResourceCtx)
+			require.Len(t, middlewares, 0)
+		})
+
+		t.Run("Should not forward OAuth Identity when calling CheckHealth", func(t *testing.T) {
+			_, err = cdt.Decorator.CheckHealth(req.Context(), &backend.CheckHealthRequest{
+				PluginContext: pluginCtx,
+				Headers:       map[string]string{otherHeader: "test"},
+			})
+			require.NoError(t, err)
+			require.NotNil(t, cdt.CheckHealthReq)
+			require.Len(t, cdt.CheckHealthReq.Headers, 1)
+			require.Equal(t, "test", cdt.CheckHealthReq.Headers[otherHeader])
+
+			middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CheckHealthCtx)
+			require.Len(t, middlewares, 0)
+		})
+	})
+
+	t.Run("When oauthPassThru configured for a datasource", func(t *testing.T) {
+		req, err := http.NewRequest(http.MethodGet, "/some/thing", nil)
+		require.NoError(t, err)
+
+		req.Header.Set(otherHeader, "test")
+
+		token := &oauth2.Token{
+			TokenType:   "bearer",
+			AccessToken: "access-token",
+		}
+		token = token.WithExtra(map[string]interface{}{"id_token": "id-token"})
+		oAuthTokenService := &oauthtokentest.Service{
+			Token: token,
+		}
+		cdt := clienttest.NewClientDecoratorTest(t,
+			clienttest.WithReqContext(req, &user.SignedInUser{}),
+			clienttest.WithMiddlewares(NewOAuthTokenMiddleware(oAuthTokenService)),
+		)
+
+		jsonDataMap := map[string]interface{}{
+			"oauthPassThru": true,
+		}
+		jsonDataBytes, err := json.Marshal(&jsonDataMap)
+		require.NoError(t, err)
+
+		pluginCtx := backend.PluginContext{
+			DataSourceInstanceSettings: &backend.DataSourceInstanceSettings{
+				JSONData: jsonDataBytes,
+			},
+		}
+
+		t.Run("Should forward OAuth Identity when calling QueryData", func(t *testing.T) {
+			_, err = cdt.Decorator.QueryData(req.Context(), &backend.QueryDataRequest{
+				PluginContext: pluginCtx,
+				Headers:       map[string]string{otherHeader: "test"},
+			})
+			require.NoError(t, err)
+			require.NotNil(t, cdt.QueryDataReq)
+			require.Len(t, cdt.QueryDataReq.Headers, 3)
+			require.Equal(t, "test", cdt.QueryDataReq.Headers[otherHeader])
+			require.Equal(t, "Bearer access-token", cdt.QueryDataReq.Headers[tokenHeaderName])
+			require.Equal(t, "id-token", cdt.QueryDataReq.Headers[idTokenHeaderName])
+
+			middlewares := httpclient.ContextualMiddlewareFromContext(cdt.QueryDataCtx)
+			require.Len(t, middlewares, 1)
+			require.Equal(t, httpclientprovider.SetHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName())
+
+			reqClone := req.Clone(req.Context())
+			res, err := middlewares[0].CreateMiddleware(httpclient.Options{}, finalRoundTripper).RoundTrip(reqClone)
+			require.NoError(t, err)
+			require.NoError(t, res.Body.Close())
+			require.Len(t, reqClone.Header, 3)
+			require.Equal(t, "test", reqClone.Header.Get(otherHeader))
+			require.Equal(t, "Bearer access-token", reqClone.Header.Get(tokenHeaderName))
+			require.Equal(t, "id-token", reqClone.Header.Get(idTokenHeaderName))
+		})
+
+		t.Run("Should forward OAuth Identity when calling CallResource", func(t *testing.T) {
+			err = cdt.Decorator.CallResource(req.Context(), &backend.CallResourceRequest{
+				PluginContext: pluginCtx,
+				Headers:       map[string][]string{otherHeader: {"test"}},
+			}, nopCallResourceSender)
+			require.NoError(t, err)
+			require.NotNil(t, cdt.CallResourceReq)
+			require.Len(t, cdt.CallResourceReq.Headers, 3)
+			require.Equal(t, "test", cdt.CallResourceReq.Headers[otherHeader][0])
+			require.Len(t, cdt.CallResourceReq.Headers[tokenHeaderName], 1)
+			require.Equal(t, "Bearer access-token", cdt.CallResourceReq.Headers[tokenHeaderName][0])
+			require.Len(t, cdt.CallResourceReq.Headers[idTokenHeaderName], 1)
+			require.Equal(t, "id-token", cdt.CallResourceReq.Headers[idTokenHeaderName][0])
+
+			middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CallResourceCtx)
+			require.Len(t, middlewares, 1)
+			require.Equal(t, httpclientprovider.SetHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName())
+
+			reqClone := req.Clone(req.Context())
+			res, err := middlewares[0].CreateMiddleware(httpclient.Options{}, finalRoundTripper).RoundTrip(reqClone)
+			require.NoError(t, err)
+			require.NoError(t, res.Body.Close())
+			require.Len(t, reqClone.Header, 3)
+			require.Equal(t, "test", reqClone.Header.Get(otherHeader))
+			require.Equal(t, "Bearer access-token", reqClone.Header.Get(tokenHeaderName))
+			require.Equal(t, "id-token", reqClone.Header.Get(idTokenHeaderName))
+		})
+
+		t.Run("Should forward OAuth Identity when calling CheckHealth", func(t *testing.T) {
+			_, err = cdt.Decorator.CheckHealth(req.Context(), &backend.CheckHealthRequest{
+				PluginContext: pluginCtx,
+				Headers:       map[string]string{otherHeader: "test"},
+			})
+			require.NoError(t, err)
+			require.NotNil(t, cdt.CheckHealthReq)
+			require.Len(t, cdt.CheckHealthReq.Headers, 3)
+			require.Equal(t, "test", cdt.CheckHealthReq.Headers[otherHeader])
+			require.Equal(t, "Bearer access-token", cdt.CheckHealthReq.Headers[tokenHeaderName])
+			require.Equal(t, "id-token", cdt.CheckHealthReq.Headers[idTokenHeaderName])
+
+			middlewares := httpclient.ContextualMiddlewareFromContext(cdt.CheckHealthCtx)
+			require.Len(t, middlewares, 1)
+			require.Equal(t, httpclientprovider.SetHeadersMiddlewareName, middlewares[0].(httpclient.MiddlewareName).MiddlewareName())
+
+			reqClone := req.Clone(req.Context())
+			res, err := middlewares[0].CreateMiddleware(httpclient.Options{}, finalRoundTripper).RoundTrip(reqClone)
+			require.NoError(t, err)
+			require.NoError(t, res.Body.Close())
+			require.Len(t, reqClone.Header, 3)
+			require.Equal(t, "test", reqClone.Header.Get(otherHeader))
+			require.Equal(t, "Bearer access-token", reqClone.Header.Get(tokenHeaderName))
+			require.Equal(t, "id-token", reqClone.Header.Get(idTokenHeaderName))
+		})
+	})
+}

pkg/services/pluginsintegration/clientmiddleware/testing.go

@@ -0,0 +1,13 @@
+package clientmiddleware
+
+import "github.com/grafana/grafana-plugin-sdk-go/backend"
+
+type callResourceResponseSenderFunc func(res *backend.CallResourceResponse) error
+
+func (fn callResourceResponseSenderFunc) Send(res *backend.CallResourceResponse) error {
+	return fn(res)
+}
+
+var nopCallResourceSender = callResourceResponseSenderFunc(func(res *backend.CallResourceResponse) error {
+	return nil
+})

pkg/services/pluginsintegration/doc.go

@@ -0,0 +1,4 @@
+// package pluginsintegration instantiate the plugins
+// package (pkg/plugins) and all of its services/dependencies that
+// Grafana needs to provide plugin support.
+package pluginsintegration

pkg/services/pluginsintegration/pluginsintegration.go

@@ -0,0 +1,81 @@
+package pluginsintegration
+
+import (
+	"github.com/google/wire"
+	"github.com/grafana/grafana/pkg/plugins"
+	"github.com/grafana/grafana/pkg/plugins/backendplugin/coreplugin"
+	"github.com/grafana/grafana/pkg/plugins/backendplugin/provider"
+	"github.com/grafana/grafana/pkg/plugins/config"
+	"github.com/grafana/grafana/pkg/plugins/manager"
+	"github.com/grafana/grafana/pkg/plugins/manager/client"
+	"github.com/grafana/grafana/pkg/plugins/manager/loader"
+	"github.com/grafana/grafana/pkg/plugins/manager/process"
+	"github.com/grafana/grafana/pkg/plugins/manager/registry"
+	"github.com/grafana/grafana/pkg/plugins/manager/signature"
+	"github.com/grafana/grafana/pkg/plugins/manager/store"
+	"github.com/grafana/grafana/pkg/plugins/plugincontext"
+	"github.com/grafana/grafana/pkg/plugins/repo"
+	"github.com/grafana/grafana/pkg/services/oauthtoken"
+	"github.com/grafana/grafana/pkg/services/pluginsintegration/clientmiddleware"
+	"github.com/grafana/grafana/pkg/setting"
+)
+
+// WireSet provides a wire.ProviderSet of plugin providers.
+var WireSet = wire.NewSet(
+	config.ProvideConfig,
+	store.ProvideService,
+	wire.Bind(new(plugins.Store), new(*store.Service)),
+	wire.Bind(new(plugins.RendererManager), new(*store.Service)),
+	wire.Bind(new(plugins.SecretsPluginManager), new(*store.Service)),
+	wire.Bind(new(plugins.StaticRouteResolver), new(*store.Service)),
+	ProvideClientDecorator,
+	wire.Bind(new(plugins.Client), new(*client.Decorator)),
+	process.ProvideService,
+	wire.Bind(new(process.Service), new(*process.Manager)),
+	coreplugin.ProvideCoreRegistry,
+	loader.ProvideService,
+	wire.Bind(new(loader.Service), new(*loader.Loader)),
+	wire.Bind(new(plugins.ErrorResolver), new(*loader.Loader)),
+	manager.ProvideInstaller,
+	wire.Bind(new(plugins.Installer), new(*manager.PluginInstaller)),
+	registry.ProvideService,
+	wire.Bind(new(registry.Service), new(*registry.InMemory)),
+	repo.ProvideService,
+	wire.Bind(new(repo.Service), new(*repo.Manager)),
+	plugincontext.ProvideService,
+)
+
+// WireExtensionSet provides a wire.ProviderSet of plugin providers that can be
+// extended.
+var WireExtensionSet = wire.NewSet(
+	provider.ProvideService,
+	wire.Bind(new(plugins.BackendFactoryProvider), new(*provider.Service)),
+	signature.ProvideOSSAuthorizer,
+	wire.Bind(new(plugins.PluginLoaderAuthorizer), new(*signature.UnsignedPluginAuthorizer)),
+)
+
+func ProvideClientDecorator(cfg *setting.Cfg, pCfg *config.Cfg,
+	pluginRegistry registry.Service,
+	oAuthTokenService oauthtoken.OAuthTokenService) (*client.Decorator, error) {
+	return NewClientDecorator(cfg, pCfg, pluginRegistry, oAuthTokenService)
+}
+
+func NewClientDecorator(cfg *setting.Cfg, pCfg *config.Cfg,
+	pluginRegistry registry.Service,
+	oAuthTokenService oauthtoken.OAuthTokenService) (*client.Decorator, error) {
+	c := client.ProvideService(pluginRegistry, pCfg)
+	middlewares := CreateMiddlewares(cfg, oAuthTokenService)
+
+	return client.NewDecorator(c, middlewares...)
+}
+
+func CreateMiddlewares(cfg *setting.Cfg, oAuthTokenService oauthtoken.OAuthTokenService) []plugins.ClientMiddleware {
+	skipCookiesNames := []string{cfg.LoginCookieName}
+	middlewares := []plugins.ClientMiddleware{
+		clientmiddleware.NewClearAuthHeadersMiddleware(),
+		clientmiddleware.NewOAuthTokenMiddleware(oAuthTokenService),
+		clientmiddleware.NewCookiesMiddleware(skipCookiesNames),
+	}
+
+	return middlewares
+}