diff --git a/packages/backend/src/plugins/auth.ts b/packages/backend/src/plugins/auth.ts
index 3b51e130ea..cd0c42afe5 100644
--- a/packages/backend/src/plugins/auth.ts
+++ b/packages/backend/src/plugins/auth.ts
@@ -98,18 +98,6 @@ export default async function createPlugin(
       // as how to sign a user in without a matching user entity in the catalog.
       // You can try it out using `<ProxiedSignInPage {...props} provider="myproxy" />`
       myproxy: providers.oauth2Proxy.create({
-        async authHandler(result) {
-          const user = result.getHeader('x-forwarded-user');
-          if (!user) {
-            throw new Error('Profile must have a username');
-          }
-          return {
-            profile: {
-              email: result.getHeader('x-forwarded-email'),
-              displayName: user,
-            },
-          };
-        },
         signIn: {
           async resolver({ result }, ctx) {
             const entityRef = stringifyEntityRef({
diff --git a/plugins/auth-backend/src/providers/oauth2-proxy/provider.ts b/plugins/auth-backend/src/providers/oauth2-proxy/provider.ts
index 1c73e2b1f3..63353f7655 100644
--- a/plugins/auth-backend/src/providers/oauth2-proxy/provider.ts
+++ b/plugins/auth-backend/src/providers/oauth2-proxy/provider.ts
@@ -23,6 +23,7 @@ import {
   AuthProviderRouteHandlers,
   AuthResponse,
   AuthResolverContext,
+  AuthHandlerResult,
 } from '../types';
 import { decodeJwt } from 'jose';
 import { prepareBackstageIdentityResponse } from '../prepareBackstageIdentityResponse';
@@ -175,6 +176,19 @@ export class Oauth2ProxyAuthProvider<JWTPayload>
   }
 }
 
+async function defaultAuthHandler(
+  result: OAuth2ProxyResult<unknown>,
+): Promise<AuthHandlerResult> {
+  return {
+    profile: {
+      email: result.getHeader('x-forwarded-email'),
+      displayName:
+        result.getHeader('x-forwarded-preferred-username') ||
+        result.getHeader('x-forwarded-user'),
+    },
+  };
+}
+
 /**
  * Auth provider integration for oauth2-proxy auth
  *
@@ -184,8 +198,12 @@ export const oauth2Proxy = createAuthProviderIntegration({
   create<JWTPayload>(options: {
     /**
      * Configure an auth handler to generate a profile for the user.
+     *
+     * The default implementation uses the value of the `X-Forwarded-Preferred-Username`
+     * header as the display name, falling back to `X-Forwarded-User`, and the value of
+     * the `X-Forwarded-Email` header as the email address.
      */
-    authHandler: AuthHandler<OAuth2ProxyResult<JWTPayload>>;
+    authHandler?: AuthHandler<OAuth2ProxyResult<JWTPayload>>;
 
     /**
      * Configure sign-in for this provider, without it the provider can not be used to sign users in.
@@ -203,7 +221,7 @@ export const oauth2Proxy = createAuthProviderIntegration({
       return new Oauth2ProxyAuthProvider<JWTPayload>({
         resolverContext,
         signInResolver,
-        authHandler,
+        authHandler: authHandler ?? defaultAuthHandler,
       });
     };
   },