Sso

/login?disableAutoLogin=true to reach the local form; grafana cli admin reset-admin-password if you also forgot the password. skip_org_role_sync: true per provider so Grafana stops overwriting roles; or role_attribute_path with role_attribute_strict. Data sources in provisioning/datasources with editable: false, secrets in secureJsonData, removal with deleteDatasources or prune: true.

Confidential OIDC client in Keycloak, pveum realm add –type openid with preferred_username as the username claim, autocreate and ACLs. The old guides with /auth/realms/ and a ‘username’ mapper are no longer needed.