Chronograf: Authentication with username and password

[AlexStreaming]

I would like to know if there is any way to configure chronograf with username and password only. I know that there is authentication by third parties as indicated here https://docs.influxdata.com/chronograf/v1.6/administration/managing-security/, but can you give access to users through a username and password?

[russorat]

@AlexStreaming thanks for the issue! We don't support basic user/pass auth in Chronograf today. I will add this as a feature request.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[stale[bot]]

This issue has been automatically closed because it has not had recent activity. Feel free to reopen if this issue is still important to you. Thank you for your contributions.

[alejandroleonb]

I would love to have the feature, thanks!

[mertbakir]

I also would love this feature and LDAP integration.

[russorat]

We have no plans to implement this in Chronograf, but I have reopened this issue if someone from the community would like to add support.

We support username/password auth in InfluxDB 2.0. If you haven't tried it yet, please do and let us know what we can improve in https://github.com/influxdata/influxdb

[ortegafernando]

I will also hope this to be implemented. I am a newbie and it is so complicated for me to configure a simple user/password in Chronograf that I have to start with grafana. I hope you will give us a "easier way to login into chronograf for our little servers for IOT.
Thanks

[or-else]

The current OAuth2-only combined with very limited features in generic OAuth2 makes Chronograf mostly unusable outside of a very limited set of supported configurations. The OAuth2-only essentially forces use of Grafana.

Is OAuth2-only a some kind of business decision? It's clearly not a technical one.

[or-else]

There is this undocumented authentication option:
https://github.com/influxdata/chronograf/blob/master/server/server.go#L111

Why isn't it documented?

[russorat]

@or-else thanks for commenting here. Those additional options were recently added and we just haven't had time to document them yet. When we release the next version of Chronograf, we will document them.

This issue is clearly important to the community. I will check internally what it might take to add this. In the meantime, if someone wants to take a crack at adding this to the app, we would be happy to review.

[or-else]

Russ, thanks for taking the time to answer my question. I do appreciate it.

This issue is clearly important to the community.

My concern is actually a bit deeper than this specific technical issue that's been unresolved for years. The key concern is confidence in Chronograf direction. You guys knew the authentication was important. None the less a decision was made to implement a complex but less usable OAuth2 vs a trivially simple and hugely usable login/password. Even now you still insist on this decision. The logic of this decision escapes me.

It does deeper. It's impossible to automate Chronograf. The API access is controlled by the same OAuth2 which is unusable for automation. Even the new PUB_KEY access control is implemented in such a way that it's obvious it was designed without experience with real deployments. What is the value of /nonce? Sure it's "more secure" in some abstract way but it's just useless complexity in any kind of real deployment. It feels like the goal was to write a Computer Science M.S. thesis as opposite to designing a real production system.

I would have guessed that the decision to cripple Chronograf's authentication was dictated by business-side of the company to entice people to buy a commercial version. But then there is no commercial version with meaningful auth options. I'm completely baffled. It's like "we built a great product but we don't want anyone to use it".

And your answer "This issue is clearly important to the community" does not give me a lot of confidence too. Is it important to the community but not important to InfluxData Inc.?

P.S. I just wasted a week trying to set up Chronograf. I really wanted it to work. I switched to Grafana and it just works.

[russorat]

@or-else thank you for your frank feedback. It's not our intention to actively build and distribute free software to hurt the community. I'm glad you were able to solve your issues with Grafana. All I can say is that we will try to do better in the future. Thanks!

[xiandong79]

I would love to have the feature, thanks!

[doctornkz]

Hello guys! I was playing with chronograf couple hours yesterday and figured out it doesn't support basic password authentication. I am sorry, but I can't believe that implement the simplest JS method to read a couple lines so unsolvable. Sorry again. Is that product still supported?

[svefro]

Also missing basic authentification.

[thehaxxa]

This is a feature that would be very desirable to many users running influxdb on local servers who don't want to deal with OAuth.

[mertbakir]

Obviously, the team is focused on InfluxDB 2.0. I would try to implement this feature but I don't have such experience. As a workaround, I've used 'httpd-tools' and 'nginx' to set a basic authentication. Still, would like to see a simple auth unified with the app.

[russorat]

So the plan here is to document the configuration needed with nginx to accomplish this.

[douglasg14b]

It's pretty awkward that by default chronograf is just open for any device to navigate to it and change anything and everything from users, to tables, to the admin password...etc without any sort of authentication...

How is this a good idea?

[russorat]

@douglasg14b totally agree that's a bad idea! We already have OAuth support which addresses this for many users. In instances where you don't have access to the internet or an OAuth service, i agree this would be useful.