unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

arrproxy: allow unverified email in oauth2-proxy
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details

Browse Source 
Authentik hardcodes email_verified=false in the id_token, so oauth2-proxy
rejects the session ("email ... isn't verified") and returns 500 on
/oauth2/callback. Set OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL=true
so the callback completes; authorization stays enforced downstream via
ak_groups. The oauth2 Deployment already carries configmap.reloader.stakater.com/auto=true
and Reloader is running, so the ConfigMap change rolls the pods automatically.
This commit is contained in:
unkin-agent
2026-08-17 22:16:37 +10:00
parent 5466562bc1
commit 43b62696ee
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/base/arrstack/arrproxy/oauth2-proxy-configmap.yaml
+5
View File
@@ -37,6 +37,11 @@ data:
# /sonarr/api but NOT /api/tokens or /api/me (which stay authenticated).
OAUTH2_PROXY_SKIP_AUTH_REGEX: "^/[^/]+/api"
OAUTH2_PROXY_EMAIL_DOMAINS: "*"
# Authentik hardcodes email_verified=false in the id_token; without this
# oauth2-proxy rejects the session ("email ... isn't verified") -> 500 on
# /oauth2/callback. Authorization is enforced downstream via ak_groups, so
# accepting the unverified email here is safe.
OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL: "true"
OAUTH2_PROXY_COOKIE_SECURE: "true"
OAUTH2_PROXY_COOKIE_DOMAINS: "arrstack.unkin.net"
OAUTH2_PROXY_WHITELIST_DOMAINS: "arrstack.unkin.net"