From 43b62696eed9e1d69dd239aca822db9d43464810 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Mon, 17 Aug 2026 22:16:37 +1000 Subject: [PATCH] arrproxy: allow unverified email in oauth2-proxy Authentik hardcodes email_verified=false in the id_token, so oauth2-proxy rejects the session ("email ... isn't verified") and returns 500 on /oauth2/callback. Set OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL=true so the callback completes; authorization stays enforced downstream via ak_groups. The oauth2 Deployment already carries configmap.reloader.stakater.com/auto=true and Reloader is running, so the ConfigMap change rolls the pods automatically. --- apps/base/arrstack/arrproxy/oauth2-proxy-configmap.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/apps/base/arrstack/arrproxy/oauth2-proxy-configmap.yaml b/apps/base/arrstack/arrproxy/oauth2-proxy-configmap.yaml index e850f40..a7eee62 100644 --- a/apps/base/arrstack/arrproxy/oauth2-proxy-configmap.yaml +++ b/apps/base/arrstack/arrproxy/oauth2-proxy-configmap.yaml @@ -37,6 +37,11 @@ data: # /sonarr/api but NOT /api/tokens or /api/me (which stay authenticated). OAUTH2_PROXY_SKIP_AUTH_REGEX: "^/[^/]+/api" OAUTH2_PROXY_EMAIL_DOMAINS: "*" + # Authentik hardcodes email_verified=false in the id_token; without this + # oauth2-proxy rejects the session ("email ... isn't verified") -> 500 on + # /oauth2/callback. Authorization is enforced downstream via ak_groups, so + # accepting the unverified email here is safe. + OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL: "true" OAUTH2_PROXY_COOKIE_SECURE: "true" OAUTH2_PROXY_COOKIE_DOMAINS: "arrstack.unkin.net" OAUTH2_PROXY_WHITELIST_DOMAINS: "arrstack.unkin.net"