"User Sync Failed" when using Grafana with Authentik

So I’ve got grafana and authentik running nicely, but I’ve never been able to make authentik work as an oauth provider for authentik. I have the following grafana.ini config in my helm chart (I’ve redacted the domain just for a bit of privacy):

      grafana.ini:
        users:
          auto_assign_org: true
          auto_assign_org_id: 1
          auto_assign_org_role: Viewer
        auth:
          signout_redirect_url: https://auth.*****/application/o/grafana/end-session/
          oauth_auto_login: true
        auth.generic_oauth:
          enabled: true
          name: Authentik
          client_id: $__env{GF_AUTH_GENERIC_OAUTH_CLIENT_ID}
          client_secret: $__env{GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET}
          scopes: openid profile email
          login_attribute_path: preferred_username
          groups_attribute_path: groups
          name_attribute_path: name
          empty_scopes: false
          use_pkce: true
          icon: signin
          auth_url: https://auth.*****/application/o/authorize/
          token_url: https://auth.*****/application/o/token/
          api_url: https://auth.*****/application/o/userinfo/
          role_attribute_path: contains(groups, 'Grafana Admins') && 'Admin' || contains(groups, 'Grafana Editors') && 'Editor' || 'Viewer'
        server:
          domain: grafana.*****
          root_url: https://grafana.*****

When I try to login with authentik, I am able to go through the sign in prompts, but then I get redirected to the login screen where grafana says “login sync failed”. I’m guessing this has something to do with grafana not being able to map the authentik user to the existing grafana user but I’m not sure. Both my grafana and authentik username are the same. I see you can add JMESPath expressions under the “user mapping” section on the UI, but I have no idea how these work.

If anyone could point me in the right direction, that would be appreciated.

Does anyone have any ideas?