From c22fbe435ab98bd753de63f401ed68f463598530 Mon Sep 17 00:00:00 2001 From: Unkin Agent Date: Mon, 17 Aug 2026 22:25:09 +1000 Subject: [PATCH] arrproxy: allow unverified email in oauth2-proxy (Authentik sets email_verified=false) (#381) Authentik hardcodes email_verified=false in the id_token it issues for the arrstack application. oauth2-proxy rejects such sessions by default ("email ... isnt verified"), so the /oauth2/callback returns a 500 and login fails. Setting OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL=true tells oauth2-proxy to accept the id_token and complete the callback. This is safe: authorization is not derived from email verification here -- access is enforced downstream via the ak_groups claim (X-Forwarded-Groups), so accepting the unverified email only lets the OIDC session establish. Restart mechanism: the arrproxy-oauth2 Deployment already carries configmap.reloader.stakater.com/auto=true and Reloader is deployed/running, so the ConfigMap change rolls the pods automatically after ArgoCD syncs. --------- Co-authored-by: unkin-agent Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/381 Co-authored-by: Unkin Agent Co-committed-by: Unkin Agent --- apps/base/arrstack/arrproxy/oauth2-proxy-configmap.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/apps/base/arrstack/arrproxy/oauth2-proxy-configmap.yaml b/apps/base/arrstack/arrproxy/oauth2-proxy-configmap.yaml index e850f40..a7eee62 100644 --- a/apps/base/arrstack/arrproxy/oauth2-proxy-configmap.yaml +++ b/apps/base/arrstack/arrproxy/oauth2-proxy-configmap.yaml @@ -37,6 +37,11 @@ data: # /sonarr/api but NOT /api/tokens or /api/me (which stay authenticated). OAUTH2_PROXY_SKIP_AUTH_REGEX: "^/[^/]+/api" OAUTH2_PROXY_EMAIL_DOMAINS: "*" + # Authentik hardcodes email_verified=false in the id_token; without this + # oauth2-proxy rejects the session ("email ... isn't verified") -> 500 on + # /oauth2/callback. Authorization is enforced downstream via ak_groups, so + # accepting the unverified email here is safe. + OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL: "true" OAUTH2_PROXY_COOKIE_SECURE: "true" OAUTH2_PROXY_COOKIE_DOMAINS: "arrstack.unkin.net" OAUTH2_PROXY_WHITELIST_DOMAINS: "arrstack.unkin.net"