unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

arrproxy: allow unverified email in oauth2-proxy (Authentik sets email_verified=false) #381

Merged
benvin merged 1 commits from benvin/arrproxy-oauth-emailverify into main 2026-08-17 22:25:09 +10:00
Conversation 0 Commits 1 Files Changed 1
+5
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/base/arrstack/arrproxy/oauth2-proxy-configmap.yaml
+5
View File
@@ -37,6 +37,11 @@ data:
# /sonarr/api but NOT /api/tokens or /api/me (which stay authenticated).
OAUTH2_PROXY_SKIP_AUTH_REGEX: "^/[^/]+/api"
OAUTH2_PROXY_EMAIL_DOMAINS: "*"
# Authentik hardcodes email_verified=false in the id_token; without this
# oauth2-proxy rejects the session ("email ... isn't verified") -> 500 on
# /oauth2/callback. Authorization is enforced downstream via ak_groups, so
# accepting the unverified email here is safe.
OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL: "true"
OAUTH2_PROXY_COOKIE_SECURE: "true"
OAUTH2_PROXY_COOKIE_DOMAINS: "arrstack.unkin.net"
OAUTH2_PROXY_WHITELIST_DOMAINS: "arrstack.unkin.net"