title: Grafana Oauth Proxy still displaying native login form
body: <p>Attempting to use Google's Oauth Proxy service and Grafana's Auth Proxy configuration, but Grafana still displays login form.</p>
  <p>Google login dialog is displayed as expected, but once authenticated it is expected that the user is then authenticated by Grafana.</p>
  <p>Setup:
  Kubernetes (AWS/EKS)
  Oauth Proxy enabled for ingress-nginx</p>
  <pre><code>apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    name: oauth2-proxy
    namespace: monitoring
  spec:
    rules:
    - host: grafana.*domain*
      http:
        paths:
        - backend:
            serviceName: oauth2-proxy
            servicePort: 4180
          path: /oauth2
  ...
    tls:
    - hosts:
      - grafana.*domain*
  </code></pre>
  <p>Grafana ingress:</p>
  <pre><code>...
  Rules:
    Host                        Path  Backends
    ----                        ----  --------
    grafana.*domain*  
                                /   prometheus-operator-grafana:80 (192.168.2.91:3000)
  Annotations:                  helm.fluxcd.io/antecedent: monitoring:helmrelease/prometheus-operator
                                kubernetes.io/ingress.class: nginx
                                nginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri
                                nginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth
  </code></pre>
  <p>Grafana.ini: as per <a href="https://grafana.com/docs/grafana/latest/auth/auth-proxy/" rel="nofollow noreferrer">https://grafana.com/docs/grafana/latest/auth/auth-proxy/</a></p>
  <pre><code>[analytics]
  check_for_updates = true
  [auth]
  oauth_auto_login = true
  signout_redirect_url = https://grafana.*domain*
  [auth.proxy]
  auto_sign_up = true
  enable_login_token = false
  enabled = true
  header_name = X-WEBAUTH-USER
  header_property = username
  headers = Name:X-WEBAUTH-NAME Email:X-WEBAUTH-EMAIL Groups:X-WEBAUTH-GROUPS
  [grafana_net]
  url = https://grafana.net
  [log]
  mode = console
  [paths]
  data = /var/lib/grafana/data
  logs = /var/log/grafana
  plugins = /var/lib/grafana/plugins
  provisioning = /etc/grafana/provisioning
  [server]
  domain = *domain*
  root_url = https://grafana.*domain*
  [users]
  allow_sign_up = false
  auto_assign_org = true
  auto_assign_org_role = Admin
  </code></pre>
  <p>User is prompted for Google Authentication as desired.
  However Grafana still presents login dialog, despite presence of</p>
  <pre><code>[auth]
  oauth_auto_login = true
  </code></pre>
  <p>Log from Nginx</p>
  <pre><code>192.168.77.87 - xxxxxxxxxxxxxxxxx [2020/06/24 15:59:52] [AuthSuccess] Authenticated via OAuth2: Session{email:xxxxxxxxxn@domain user:nnnnnnnnnnnnnnnnnnnn PreferredUsername: token:true id_token:true created:2020-06-24 15:59:52.238393221 +0000 UTC m=+106369.587921725 expires:2020-06-24 16:59:51 +0000 UTC refresh_token:true}
  192.168.77.87 - - [2020/06/24 15:59:52] grafana.domain GET - &quot;/oauth2/callback?state=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:/&amp;code=xxxxxxxxxxxxxxxxxxxxxxxxx&amp;scope=email%20profile%20https://www.googleapis.com/auth/userinfo.profile%20https://www.googleapis.com/auth/userinfo.email%20openid&amp;authuser=0&amp;hd=domain&amp;prompt=consent&quot; HTTP/1.1 &quot;Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:77.0) Gecko/20100101 Firefox/77.0&quot; 302 24 0.181
  </code></pre>
  <p>Log from Oauth Proxy:</p>
  <pre><code>192.168.17.214 - - [24/Jun/2020:15:59:52 +0000] &quot;GET /oauth2/auth HTTP/1.1&quot; 202 0 &quot;https://accounts.google.com/signin/oauth/oauthchooseaccount?access_type=offline&amp;acr_values&amp;approval_prompt=force&amp;client_id=client_id&amp;redirect_uri=https%3A%2F%2Fgrafana.domain%2Foauth2%2Fcallback&amp;response_type=code&amp;scope=profile%20email&amp;state=xxxxxxxxxxxxxxxxxxxxxxxxxx&amp;flowName=GeneralOAuthFlow&quot; &quot;Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:77.0) Gecko/20100101 Firefox/77.0&quot; 1217 0.004 [monitoring-oauth2-proxy-4180] [] 192.168.44.224:4180 0 0.004 202 xxxxxxxxxxxxxxxxxxxxxxxxxx
  192.168.6.127 - - [24/Jun/2020:15:59:52 +0000] &quot;GET /login HTTP/2.0&quot; 202 0 &quot;https://accounts.google.com/signin/oauth/oauthchooseaccount?access_type=offline&amp;acr_values&amp;approval_prompt=force&amp;client_id=client_id&amp;redirect_uri=https%3A%2F%2Fgrafana.domain%2Foauth2%2Fcallback&amp;response_type=code&amp;scope=profile%20email&amp;state=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxQg&amp;flowName=GeneralOAuthFlow&quot; &quot;Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:77.0) Gecko/20100101 Firefox/77.0&quot; 0 0.052 [monitoring-prometheus-operator-grafana-80] [] 54.76.77.91:443 0 0.048 202 xxxxxxxxxxxxxxxxxxxxxxxxxxxx
  192.168.6.127 - - [24/Jun/2020:15:59:52 +0000] &quot;GET /login HTTP/2.0&quot; 200 6822 &quot;https://accounts.google.com/signin/oauth/oauthchooseaccount?access_type=offline&amp;acr_values&amp;approval_prompt=force&amp;client_id=client_id&amp;redirect_uri=https%3A%2F%2Fgrafana.dmoain%2Foauth2%2Fcallback&amp;response_type=code&amp;scope=profile%20email&amp;state=xxxxxxxxxxxxxxxxxxxxxxxxx&amp;flowName=GeneralOAuthFlow&quot; &quot;Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:77.0) Gecko/20100101 Firefox/77.0&quot; 32 0.056 [monitoring-prometheus-operator-grafana-80] [] 192.168.2.91:3000 27042 0.008 200 xxxxxxxxxxxxxxxxxxxxxxxxxxx
  </code></pre>
  <p>Note instance can be made to work via auth.google however that requires the secret held with grafana.ini where other clients are secured at ingress-nginx.</p>
  <p>Q. What should the Oauth callback be set to for Grafana Oauth Proxy?</p>