How authentication happens in Grafana with auth proxy

[gauravgsgsits]

I have enabled [auth.generic_oauth] section in grafana.ini in order to login grafana gui from keycloak. After integration, I am able to login in grafana ui using keycloak authentication.
Now for other requirement, I need to call Grafana alert manager’s alerting APIs from backend code (for testing purpose, as of now I am using curl). After integration with keycloak (as mentioned above with auth.generic_oauth), API calls for service account creation and service token are failed.
In order to make it work, I have enabled auth.proxy in grafana.ini as below -

[auth.proxy]
enabled = true
header_name = X-Authenticated-User
header_property = username
auto_sign_up = true
sync_ttl = 15
whitelist = some_ipv4_ip
headers =
headers_encoded = false
enable_login_token = true

So what does this setting means in grafan.ini, Does grafana act as auth proxy server if yes, then how authentication happening with this setting as there is no option to provide the credentials.
If Grafana doesn’t act as auth proxy server and some external auth proxy server required then how it would be provided in the setting. If possible provide some examples.

Thanks,
Gaurav

[jangaraj]

There is no Grafana authentication - you offloaded authentication/authorization outside of Grafana in this setup:

How to integrate keycloak with grafana backend API in version 11.5

This config means: hey Grafana - don’t use your auth, but trust what you will receive in the X-Authenticated-User header (e.g. if there is admin, so it is admin user, etc). You must ensure that the request was authenticated/authorized before it reaches Grafana (you set up auth proxy in front of Grafana - you likes OIDC, so you will set up some OIDC auth proxy) - Grafana is just a blind app, which follows/trusts the header value in this setup.