Grafana : How to use JWT authentication?

Question

I want to use JWT for Grafana login authentication, Grafana docs dictate some steps for the same but [auth.jwt] default is not provided in sample.ini, and can you clarify what it means by header name that contains a token in the step mentioned for enabling JWT ?

Answer 1

This is the header providing a jwt payload from the proxy in front of grafana - in the case of IAP(https://cloud.google.com/iap/docs/signed-headers-howto) for example: x-goog-iap-jwt-assertion. The contents of this header is validated by the use of either source speficied i jwk_set_url, jwk_set_file or key_file, after which the claims for example for username and email can be fetched. Examples on IAP for this also available in the url above:

   auth.jwt:
      enabled: true
      header_name: x-goog-iap-jwt-assertion
      username_claim: sub
      email_claim: email
      jwk_set_url: https://www.gstatic.com/iap/verify/public_key-jwk

Note however - auth.jwt currently "broken by design" as mentioned in: Authentication Grafana via JWT