Managed Service for Grafana:Share Grafana dashboards with API keys

Base64 encodes binary data as printable characters for safe transmission.

• You can use an online tool, such as base64, to decode the API key.

• Decode in Java.

  package main
  
  import java.util.Base64;
  
  public class Base64Example{
      public static void main(String[] args) {
          String apiKey = "eyJr****REpzZGYzd2JIa0N3ekgyWjlWWmhrSTM5bWdGT2hGSmwiLCJuIjoidGVzdDEiLCJpZCI6MX0=";
          String decodeKey = new String(Base64.getDecoder().decode(apiKey));
          System.out.println(decodeKey);
      }
  }

  Output:

  {"k":"DJsd****HkCwzH2Z9VZhkI39mgFOhFJl","n":"test1","id":1}

• Decode in Go.

  package main
  
  import "fmt"
  import "encoding/base64"
  
  func main() {
  	apiKey := "eyJr****REpzZGYzd2JIa0N3ekgyWjlWWmhrSTM5bWdGT2hGSmwiLCJuIjoidGVzdDEiLCJpZCI6MX0="
  	decodeKey, err := base64.StdEncoding.DecodeString(apiKey)
  	if err != nil {
  		fmt.Println(err.Error())
  		return
  	}
  	fmt.Println(string(decodeKey))
  }

  Output:

  {"k":"DJsd****HkCwzH2Z9VZhkI39mgFOhFJl","n":"test1","id":1}

PBKDF2 derives an encryption key from a password, a salt, and an iteration count. It makes offline cracking difficult if a database is compromised.

The following table describes the encryption parameters.

• You can use an online tool, such as df2, to encrypt the key.

• Encrypt in Java.

  package main
  
  import javax.crypto.SecretKeyFactory;
  import java.security.GeneralSecurityException;
  import javax.crypto.spec.PBEKeySpec;
  import java.security.spec.KeySpec;
  
  public class PBKDFExapmle {
      public static void main(String[] args) {
          String password = "DJsd****HkCwzH2Z9VZhkI39mgFOhFJl";
          String salt = "test1";
          int iterationCount = 10000;
          int outputLength = 50 * 8;
  
          try {
              KeySpec spec = new PBEKeySpec(password.toCharArray(), salt.getBytes(), iterationCount, outputLength);
              SecretKeyFactory skf = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256");
              byte[] keyBytes = skf.generateSecret(spec).getEncoded();
              System.out.println(bytesToHex(keyBytes));
          } catch (GeneralSecurityException e) {
              e.printStackTrace();
          }
      }
  
      private static String bytesToHex(byte[] bytes) {
          StringBuilder hexString = new StringBuilder();
          for (byte b : bytes) {
              String hex = Integer.toHexString(0xff & b);
              if (hex.length() == 1) {
                  hexString.append('0');
              }
              hexString.append(hex);
          }
          return hexString.toString();
      }
  }
  

  Output: PBKDF2 Password

  1e5b****80184e78832544aae4d2e031a3539c10b575b75d7c1d44af49fcf5a7de9c58a5f0035ce35fff0e5b0476e882****

• Encrypt in Go.

  package main
  
  import "fmt"
  import "encoding/hex"
  import "crypto/sha256"
  import "golang.org/x/crypto/pbkdf2"
  
  func main() {
      password:="DJsd****HkCwzH2Z9VZhkI39mgFOhFJl"
      salt="test1"
      newPasswd := pbkdf2.Key([]byte(password), []byte(salt), 10000, 50, sha256.New)
  	encodePassword:= hex.EncodeToString(newPasswd)
  	fmt.Println(encodePassword)
  }

  Output: PBKDF2 Password

  1e5b****80184e78832544aae4d2e031a3539c10b575b75d7c1d44af49fcf5a7de9c58a5f0035ce35fff0e5b0476e882****

The MD5 digest algorithm is a cryptographic hash function that produces a 128-bit hash value to verify data integrity.

Content to be encrypted: <PBKDF2 Password>+"_"+<Current system time as an integer in seconds>

Example:

PBKDF2 Password: 1e5b****80184e78832544aae4d2e031a3539c10b575b75d7c1d44af49fcf5a7de9c58a5f0035ce35fff0e5b0476e882****

Current system time: 2024-09-20 17:12:13, which is 1726823533 in seconds.

The complete information to be signed with MD5: 1e5b****80184e78832544aae4d2e031a3539c10b575b75d7c1d44af49fcf5a7de9c58a5f0035ce35fff0e5b0476e882****_1726823533

You can create an MD5 signature in several ways:

• Use an online tool, such as MD5, to perform the encryption.

• Perform MD5 signing by using Java code.

  package main;
  
  import java.security.MessageDigest;
  
  
  public class MD5 {
  
      public static void main(String[] args) {
          String pbkdfPassword = "1e5b****80184e78832544aae4d2e031a3539c10b575b75d7c1d44af49fcf5a7de9c58a5f0035ce35fff0e5b0476e882****";
          long timeSeconds=System.currentTimeMillis()/1000;
          String key=pbkdfPassword+"_"+timeSeconds;
          System.out.println(MD5.getMD5String(key,"UTF-8"));
      }
  
      
      public static String getMD5String(String str, String charset) {
          try {
              MessageDigest messageDigest = MessageDigest.getInstance("MD5");
              messageDigest.reset();
              messageDigest.update(str.getBytes(charset));
              byte[] byteArray = messageDigest.digest();
  
              StringBuffer md5StrBuff = new StringBuffer();
  
              for (int i = 0; i < byteArray.length; i++) {
                  if (Integer.toHexString(0xFF & byteArray[i]).length() == 1) {
                      md5StrBuff.append("0").append(
                          Integer.toHexString(0xFF & byteArray[i]));
                  } else {
                      md5StrBuff.append(Integer.toHexString(0xFF & byteArray[i]));
                  }
              }
              return md5StrBuff.toString().toLowerCase();
          } catch (Exception e) {
              e.printStackTrace();
              throw new RuntimeException("MD5 error:"+e.getMessage());
          }
      }
  }
  

• Perform MD5 signing by using Go code.

  package main
   
  import (
      "crypto/md5"
      "encoding/hex"
      "fmt"
      "io"
      "time"
      "strconv"
  )
   
  func main() {
      // String to calculate MD5 for
      pbkdfPassword := "1e5b****80184e78832544aae4d2e031a3539c10b575b75d7c1d44af49fcf5a7de9c58a5f0035ce35fff0e5b0476e882****"
      timeSeconds:= time.Now().Unix()
      key:=pbkdfPassword+"_"+strconv.FormatInt(timeSeconds, 10)
   
      // Calculate the MD5 of the string
      hash := md5.New()
      io.WriteString(hash, key)
      md5Str := hash.Sum(nil)
   
      // Convert the binary MD5 value to a hexadecimal string
      md5StrHex := hex.EncodeToString(md5Str)
   
      fmt.Println("MD5 of", key, "is", md5StrHex)
  }

Parameter description:

Example:

https://grafana-example.grafana.aliyuncs.com/d/TZWea****/test?orgId=1&from=167081684****&to=167083844****&aliyun_api_key_sign=c3bf89b867cc88df72d507edc4d1****&aliyun_api_key_timestamp=1726823533&aliyun_api_key_name=test1&aliyun_api_key_org_id=1

You can now programmatically generate secure, login-free links to Grafana without exposing the long-lived API key.

PBKDF2 derives an encryption key from a password, a salt, and an iteration count. It makes offline cracking difficult if a database is compromised.

Split the service account token by the underscore character (_).

# Example service account token:
Token:glsa_yV9HAOVCjNKkvKoLMiypOc5T0Oov****_4f5ff3ce
# After splitting:
Prefix:glsa
Secret:yV9HAOVCjNKkvKoLMiypOc5T0Oov****
Salt:4f5ff3ce

The following table describes the encryption parameters.

• You can use an online tool, such as charsetpbkdf2, to encrypt the key.

• Encrypt in Java.

  package main
  
  import javax.crypto.SecretKeyFactory;
  import java.security.GeneralSecurityException;
  import javax.crypto.spec.PBEKeySpec;
  import java.security.spec.KeySpec;
  
  public class PBKDFExapmle {
      public static void main(String[] args) {
          String password = "yV9H****jNKkvKoLMiypOc5T0OovHXPV";
          String salt = "4f5ff3ce";
          int iterationCount = 10000;
          int outputLength = 50 * 8;
  
          try {
              KeySpec spec = new PBEKeySpec(password.toCharArray(), salt.getBytes(), iterationCount, outputLength);
              SecretKeyFactory skf = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256");
              byte[] keyBytes = skf.generateSecret(spec).getEncoded();
              System.out.println(bytesToHex(keyBytes));
          } catch (GeneralSecurityException e) {
              e.printStackTrace();
          }
      }
  
      private static String bytesToHex(byte[] bytes) {
          StringBuilder hexString = new StringBuilder();
          for (byte b : bytes) {
              String hex = Integer.toHexString(0xff & b);
              if (hex.length() == 1) {
                  hexString.append('0');
              }
              hexString.append(hex);
          }
          return hexString.toString();
      }
  }
  

  Output: PBKDF2 Password

  c3cd****971bab928e4ecd6e7a00c74657696ea07d38c43f3bb5dc3190f2285cb80695cf7bf2f25c9b1f34fe1e0f9549****

• Encrypt in Go.

  package main
  
  import "fmt"
  import "encoding/hex"
  import "crypto/sha256"
  import "golang.org/x/crypto/pbkdf2"
  
  func main() {
      password:="yV9H****jNKkvKoLMiypOc5T0OovHXPV"
      salt:="4f5ff3ce"
      newPasswd := pbkdf2.Key([]byte(password), []byte(salt), 10000, 50, sha256.New)
  	encodePassword:= hex.EncodeToString(newPasswd)
  	fmt.Println(encodePassword)
  }

  Output: PBKDF2 Password

  c3cd****971bab928e4ecd6e7a00c74657696ea07d38c43f3bb5dc3190f2285cb80695cf7bf2f25c9b1f34fe1e0f9549****

The MD5 digest algorithm is a cryptographic hash function that produces a 128-bit hash value to verify data integrity.

Content to be encrypted: <PBKDF2 Password>+"_"+<Current system time as an integer in seconds>

Example:

PBKDF2 Password: c3cd****971bab928e4ecd6e7a00c74657696ea07d38c43f3bb5dc3190f2285cb80695cf7bf2f25c9b1f34fe1e0f9549****

Current system time: 2024-09-20 17:12:13, which is 1726823533 in seconds.

The complete information to be signed with MD5: c3cd****971bab928e4ecd6e7a00c74657696ea07d38c43f3bb5dc3190f2285cb80695cf7bf2f25c9b1f34fe1e0f9549****_1726823533

You can create an MD5 signature in several ways:

• Use an online tool, such as MD5, to perform the encryption.

• Perform MD5 signing by using Java code.

  package main;
  
  import java.security.MessageDigest;
  
  
  public class MD5 {
  
      public static void main(String[] args) {
          String pbkdfPassword = "c3cd****971bab928e4ecd6e7a00c74657696ea07d38c43f3bb5dc3190f2285cb80695cf7bf2f25c9b1f34fe1e0f9549****";
          long timeSeconds=System.currentTimeMillis()/1000;
          String key=pbkdfPassword+"_"+timeSeconds;
          System.out.println(MD5.getMD5String(key,"UTF-8"));
      }
  
      
      public static String getMD5String(String str, String charset) {
          try {
              MessageDigest messageDigest = MessageDigest.getInstance("MD5");
              messageDigest.reset();
              messageDigest.update(str.getBytes(charset));
              byte[] byteArray = messageDigest.digest();
  
              StringBuffer md5StrBuff = new StringBuffer();
  
              for (int i = 0; i < byteArray.length; i++) {
                  if (Integer.toHexString(0xFF & byteArray[i]).length() == 1) {
                      md5StrBuff.append("0").append(
                          Integer.toHexString(0xFF & byteArray[i]));
                  } else {
                      md5StrBuff.append(Integer.toHexString(0xFF & byteArray[i]));
                  }
              }
              return md5StrBuff.toString().toLowerCase();
          } catch (Exception e) {
              e.printStackTrace();
              throw new RuntimeException("MD5 error:"+e.getMessage());
          }
      }
  }
  

• Perform MD5 signing by using Go code.

  package main
   
  import (
      "crypto/md5"
      "encoding/hex"
      "fmt"
      "io"
      "time"
      "strconv"
  )
   
  func main() {
      // String to calculate MD5 for
      pbkdfPassword := "c3cd****971bab928e4ecd6e7a00c74657696ea07d38c43f3bb5dc3190f2285cb80695cf7bf2f25c9b1f34fe1e0f9549****"
      timeSeconds:= time.Now().Unix()
      key:=pbkdfPassword+"_"+strconv.FormatInt(timeSeconds, 10)
   
      // Calculate the MD5 of the string
      hash := md5.New()
      io.WriteString(hash, key)
      md5Str := hash.Sum(nil)
   
      // Convert the binary MD5 value to a hexadecimal string
      md5StrHex := hex.EncodeToString(md5Str)
   
      fmt.Println("MD5 of", key, "is", md5StrHex)
  }

Parameter description:

Example:

https://grafana-example.grafana.aliyuncs.com/d/TZWea****/test?orgId=1&from=167081684****&to=167083844****&aliyun_api_key_sign=c3bf89b867cc88df72d507edc4d1****&aliyun_api_key_timestamp=1726823533&aliyun_api_key_name=sa-1-******-*******-75c7-41ae-94da-*********&aliyun_api_key_org_id=1

You can now programmatically generate more secure, passwordless links to Grafana, which helps prevent exposing the long-lived service account token.