Clarify Prometheus capability in auth guide (#4399)

* Clarify Prometheus capability in auth guide

Signed-off-by: Tom Hayward <[email protected]>

Co-authored-by: Marco Pracucci <[email protected]>

Author: kd7lxl

docs/guides/authentication-and-authorisation.md

@@ -15,12 +15,19 @@ of protection.
 Typically this means you run Cortex behind a reverse proxy, and you must
 ensure that all callers, both machines sending data over the `remote_write`
 interface and humans sending queries from GUIs, supply credentials
-which identify them and confirm they are authorised.
-
-When configuring the `remote_write` API in Prometheus there is no way to
-add extra headers. The user and password fields of http Basic auth, or
-Bearer token, can be used to convey the tenant ID and/or credentials.
-See the **Cortex-Tenant** section below for one way to solve this.
+which identify them and confirm they are authorised. When configuring the
+`remote_write` API in Prometheus, the user and password fields of http Basic
+auth, or Bearer token, can be used to convey the tenant ID and/or credentials.
+See the [Cortex-Tenant](#cortex-tenant) section below for one way to solve this.
+
+In trusted environments, Prometheus can send the `X-Scope-OrgID` header itself
+by configuring the `headers` field in its [`remote_write` configuration](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#remote_write):
+```
+remote_write:
+  - url: http://<cortex>/prometheus/api/v1/push
+    headers:
+      X-Scope-OrgID: <org>
+```
 
 To disable the multi-tenant functionality, you can pass the argument
 `-auth.enabled=false` to every Cortex component, which will set the OrgID