Grafana authelia integration, token_endpoint_auth_method problem

[Marc-Proux]

Hi,
I'm trying to integrate Authelia in Grafana but I have an issue with the token_endpoint_auth_method configuration.

The error generated in Authelia log:

The request was determined to be using 'token_endpoint_auth_method' method 'none', however the OAuth 2.0 client registration does not allow this method. The registered client with id 'grafana' is configured to only support 'token_endpoint_auth_method' method 'client_secret_basic'

Same in Grafana log:

level=error msg="Failed to authenticate request" client=auth.client.generic_oauth error="[auth.oauth.token.exchange] failed to exchange code to token: oauth2: \"invalid_client\" \"Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The request was determined to be using 'token_endpoint_auth_method' method 'none', however the OAuth 2.0 client registration does not allow this method.\""

My Authelia clients config:

- client_id: 'grafana'
        client_name: 'Grafana'
        client_secret: ....
        public: false
        authorization_policy: 'one_factor'
        require_pkce: true
        pkce_challenge_method: 'S256'
        redirect_uris:
          - 'https://grafana.arcadia-hub.com/login/generic_oauth'
        scopes:
          - 'openid'
          - 'profile'
          - 'groups'
          - 'email'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_basic'

I tried to remove the token_endpoint_auth_method line (in the doc they the default value is 'client_secret_basic' or change it to client_secret_post but the error always says that the value is none

[glime-ai[bot]]

Please note this response was created using generative AI leveraging previously available information from the repository. This information may be helpful however it is our strong recommendation that you carefully consider the information before blindly applying it.

---

It appears that the issue you're encountering is related to a mismatch in the token_endpoint_auth_method configuration between Authelia and Grafana. The error logs indicate that Grafana is attempting to use the method 'none', which is not supported by the Authelia client configuration for Grafana, which is set to 'client_secret_basic'.

Here are a few steps to troubleshoot and resolve this issue:

1. Verify Grafana Configuration: Ensure that Grafana is configured to use the correct client authentication method. This is typically set in the OAuth configuration section of Grafana. You might need to explicitly set the authentication method to 'client_secret_basic' if Grafana defaults to 'none' when not specified.

2. Check Authelia Configuration: Your Authelia configuration looks correct as it specifies 'client_secret_basic'. However, ensure that this configuration is properly loaded and applied. Sometimes, configuration changes might require a restart of the Authelia service to take effect.

3. Default Behavior and Documentation: As per the documentation, if token_endpoint_auth_method is omitted, the default should be 'client_secret_basic'. However, since the error suggests that 'none' is being used, it's crucial to explicitly define this in both Authelia and Grafana configurations to avoid defaults that might not be applied as expected.

4. Logs and Debugging: Review the logs in more detail around the time the error occurs to see if there are any additional messages that might indicate why the 'none' method is being used. This might give clues whether the issue is on the Grafana side or the Authelia side.

5. Update and Compatibility Check: Ensure that both Grafana and Authelia are updated to versions that support the configurations you are attempting to use. Sometimes, version mismatches can lead to unexpected behavior.

If after these steps the issue persists, you might want to explicitly set the token_endpoint_auth_method in Grafana's OAuth configuration (if such an option is available) or consult the Grafana documentation or support for more details on how it handles client authentication methods for OAuth.

This comment was generated by Glime.

[Marc-Proux]

I think the problem was in the Grafana Docker Compose. It didn't recognize the client_secret variable from the secrets.
I've removed all the environment variables and simply configured the grafana.ini file, and now it works.