Skip to main content

TIMEOUT Issue

 Status Update:

Investigation into the recurring "Unauthorized" pop-up identified a probable cause in the Grafana configuration. The grafana.ini [auth] section contains:

login_maximum_lifetime_duration = 1m

In Grafana, a lowercase m means minutes, not months. This caps the maximum session lifetime at one minute, which matches the reported 30-second to 2-minute cycle of the "Unauthorized" pop-up and forced refresh. The Grafana default for this setting is 30d.

A secondary contributing factor is under review: whether Grafana is configured to use the Keycloak refresh token (use_refresh_token). Without it, Grafana cannot silently renew an expired access token, so the browser receives a 401 when Keycloak's access token lifespan elapses. Keycloak's default access token lifespan is 5 minutes, which could produce the same symptom at a different interval.

While troubleshooting this ticket, a separate and more severe defect was found: SSO users other than the first cannot be created in Grafana at all, due to duplicate email addresses inherited from the GTAC LDAP provider. That has been raised as its own bug and has a MOP prepared. The two issues are independent, but both touch the [auth.generic_oauth] configuration, so the fixes should be sequenced rather than applied in parallel.

No configuration changes have been made yet. All findings to date are from log review and config inspection.

Next Steps:

  1. Confirm whether login_maximum_lifetime_duration = 1m was set intentionally (for example as a security requirement) or is a units mistake. — Owner: [name]
  2. Capture Keycloak's Access Token Lifespan, SSO Session Idle, and SSO Session Max values from the realm's Sessions and Tokens settings, for comparison against the observed interval.
  3. Verify NTP sync between the Grafana and Keycloak hosts. Clock drift causes tokens to be treated as expired on arrival and produces intermittent 401s.
  4. Reproduce with browser developer tools open and capture the failing request, its 401 response, and the timestamp, to confirm which token is expiring.
  5. In test, correct login_maximum_lifetime_duration to 30d (or the approved value), restart Grafana, and monitor for a minimum of 30 minutes of idle and active use.
  6. If the pop-up persists, enable use_refresh_token = true and confirm Keycloak is issuing refresh tokens to the grafana client.
  7. Sequence against the user sync bug: apply that fix first in test, since it rewrites the same config section, then re-validate this issue.

Comments

Post a Comment

Popular posts from this blog

Joke of Day

Home / Blog / 35 Cybersecurity Jokes to Make Any Security Geek Chuckle (or Groan) 35 Cybersecurity Jokes to Make Any SecurityGeek Chuckle (or Groan) Posted on September 8, 2020 Last updated on December 13, 2024. Good IT jokes are few and far between, especially when it comes to cybersecurity. That’s why we put on our creativityhats to brainstorm joke after joke – with a break to pull in a few of our favorites from the web – for the ultimate result: themotherlode (or should we say mother board ?) of cybersecurity jokes and puns. P.S.: we side with Alfred Hitchcock on thisone: puns are the highest form of literature. Everyone deserves an eye-catching intro to break the ice at the start of a meeting or spice up a PowerPoint – gotta keepthe CEO’s attention somehow! And no joke is complete without the perfect graphic. Feel free to grab ours and includethem in your next newsletter, quarterly presentation, or for a workday pick-me-up. Without further ado, we present… Our Favorite Cybersecurit...
Post a Comment
Read more

Jira 6

  BRIEF Look at open-source AI security tools we can run safely on secdesk01, and decide whether any are worth adopting. DESCRIPTION Our scanners only catch what they have a pattern for. That means noise we have to sift through, and logic flaws they miss entirely. AI tools can reason about what they're seeing instead of just pattern-matching. This ticket is about finding out whether that helps us — using open-source tools we run ourselves, so our code and findings never leave our environment. Two things to investigate, both run sandboxed against Juice Shop on secdesk01: 1. Offensive — AI agents that test like a person would. They drive a terminal or browser, chain steps together, and find flaws that need context to spot. Because they send real attack traffic, they must be locked in with no route off the VM. Tools to look at: PentAGI, Strix, PentestGPT, Nebula, CAI. 2. Guardrails — the fencing that makes the above safe. Limits on what an agent is allowed to touch, blocking o...
Post a Comment
Read more