I renamed `tlsAuth` to `tlsClientAuth` to better describe the fact that
this variable is used to enable TLS client authentication (as opposed to
server authentication) in c04d95f35.
However, changing the name breaks backwards compatibility for existing
installations using this feature and Grafana does not have a
standardised way of migrating changes in the schema:
https://github.com/grafana/grafana/pull/9377#issuecomment-333063543
For reasons of expediency given the severity of the bug (not verifying
TLS), keep the old name.
In c04d95f35 I changed the default for datasource HTTP requests so that
TLS is always verified.
This commit adds a checkbox to allow an admin to explicitly skip TLS
verification, for testing purposes.
It should be specify to either use TLS client authentication or use a
user-supplied CA; previously you had to enable client authentication to
use a custom CA.
If either is set, try to use them.
This should help avoid a situation where someone has half-configured TLS
client authentication and it doesn't work without raising an obvious
error.
TLS was not being verified in a number of places:
- connections to grafana.com
- connections to OAuth providers when TLS client authentication was
enabled
- connections to self-hosted Grafana installations when using the CLI
tool
TLS should always be verified unless the user explicitly enables an
option to skip verification.
Removes some instances where `InsecureSkipVerify` is explicitly set to
`false`, the default, to help avoid confusion and make it more difficult
to regress on this fix by accident.
Adds a `--insecure` flag to `grafana-cli` to skip TLS verification.
Adds a `tls_skip_verify_insecure` setting for OAuth.
Adds a `app_tls_skip_verify_insecure` setting under a new `[plugins]`
section.
I'm not super happy with the way the global setting is used by
`pkg/api/app_routes.go` but that seems to be the existing pattern used.
Matt Bostock