升级oauth2-proxy至v7.1.3后用户标识传递异常，求排查

AWS EKS v1.21集群中，oauth2-proxy从v5.1.0升级至v7.1.3后，Azure AD认证流程可正常完成，但测试应用获取到的X-Auth-Request-User字段值为Azure返回的随机字符串（如fF3CtUwz6hwiCWjpR3kgHCYs0Uj3Syk7sTAUs1pOJSU），而非预期的邮箱或PreferredUsername，导致应用权限验证异常。

日志信息 #

[2023/02/03 10:07:16] [stored_session.go:122] Refreshing 9m55.925357944s old session cookie for Session{email:me@mydomain.com user:fF3CtUwz6hwiCWjpR3kgHCYs0Uj3Syk7sTAUs1pOJSU PreferredUsername:me@mydomain.com token:true id_token:true created:2023-02-03 09:57:20.074642056 +0000 UTC expires:2023-02-03 11:17:21.07415738 +0000 UTC refresh_token:true} (refresh after 1m0s)

旧版本配置 #

oauth2-proxy v5.1.0配置 #

extraArgs:
  provider: azure
  cookie-name: _oauth2
  cookie-refresh: 59m
  cookie-domain: .mydomain.com
  whitelist-domain: .mydomain.com

  set-authorization-header: "true"
  set-xauthrequest: "true"
  pass-access-token: "true"
  pass-authorization-header: "true"
  pass-basic-auth: "true"
  pass-host-header: "true"
  pass-user-headers: "true"

  session-store-type: redis
  redis-connection-url: oauth2-redis-redis-ha
  redis-use-sentinel: "true"
  redis-sentinel-master-name: mymaster
  redis-sentinel-connection-urls: oauth2-redis-redis-ha:26379

旧应用Ingress配置 #

ingress:
  enabled: true
  apiVersion: "networking.k8s.io/v1"
  hostName: myapp.mydomain.com
  path: /
  kubernetes.io/ssl-redirect: true
  labels: {}
  annotations:
    kubernetes.io/ingress.class: ingress-public
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    nginx.ingress.kubernetes.io/auth-url: "http://oauth2-proxy.oauth2.svc.cluster.local/oauth2/auth"
    nginx.ingress.kubernetes.io/auth-signin: "https://login.nonprod.gmc.js-devops.co.uk/oauth2/start?rd=https://$best_http_host$escaped_request_uri"
    nginx.ingress.kubernetes.io/auth-response-headers: X-Auth-Request-Email, X-Auth-Request-User, X-Auth-Request-Access-Token

新版本配置 #

oauth2-proxy v7.1.3配置（改用OIDC） #

extraArgs:
  provider: oidc
  oidc-issuer-url: "https://login.microsoftonline.com/<azure-tenant-id>/v2.0"
  azure-tenant: "<azure-tenant-id>"
  login-url: https://login.microsoftonline.com/<azure-tenant-id>/oauth2/v2.0/authorize
  redeem-url: https://login.microsoftonline.com/<azure-tenant-id>/oauth2/v2.0/token
  oidc-jwks-url: https://login.microsoftonline.com/common/discovery/keys
  profile-url: https://graph.microsoft.com/v1.0/me
  scope: 'email profile openid offline_access'
  email-domain: "*"
  skip-jwt-bearer-tokens: "true"

  cookie-name: _oauth2_test
  cookie-refresh: 1m
  cookie-domain: .mydomain.com
  whitelist-domain: .mydomain.com

  set-authorization-header: "true"
  set-xauthrequest: "true"
  pass-access-token: "true"
  pass-authorization-header: "true"
  pass-basic-auth: "true"
  pass-host-header: "true"
  pass-user-headers: "true"

  session-store-type: redis
  redis-connection-url: redis://test-redis-redis-ha
  redis-use-sentinel: "true"
  redis-sentinel-master-name: mymaster
  redis-sentinel-connection-urls: redis://test-redis-redis-ha:26379

新应用Ingress配置 #

ingress:
  enabled: true
  apiVersion: "networking.k8s.io/v1"
  labels: {}
  annotations:
    kubernetes.io/ingress.class: ingress-public
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/auth-url: "http://oauth2-proxy.oauth2-staging.svc.cluster.local/oauth2/auth"
    nginx.ingress.kubernetes.io/auth-signin: "https://oauth2.nonprod.gmc.js-devops.co.uk/oauth2/start?rd=https://$best_http_host$escaped_request_uri"
    nginx.ingress.kubernetes.io/auth-response-headers: "X-Auth-Request-Email,X-Auth-Request-User,X-Auth-Request-Access-Token,X-Auth-Request-Preferred-Username"

已尝试的无效配置 #

nginx.ingress.kubernetes.io/configuration-snippet: |
      auth_request_set $name_upstream_1 $upstream_cookie_name_1;
      access_by_lua_block {
          if ngx.var.name_upstream_1 ~= "" then
          ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")
          end
      }

问题原因及解决方案 #

问题出在oauth2-proxy v7.x的配置逻辑上：

• v7.x版本的OIDC/Azure provider默认使用Azure AD v2.0返回的sub字段填充user标识，而sub就是你看到的随机字符串
• 旧版本v5.1.0的Azure provider默认使用邮箱作为user值，这是版本间的行为差异

解决步骤 #

在oauth2-proxy的extraArgs中添加以下两个参数，覆盖默认的用户标识字段：

extraArgs:
  # 保留原有配置...
  user-id-claim: "email"          # 指定用邮箱作为X-Auth-Request-User的值，也可设置为"preferred_username"
  preferred-username-claim: "preferred_username"  # 显式指定PreferredUsername的来源字段

另外，无需强制改用OIDC provider，v7.x的azure provider已适配Azure AD v2.0，若换回provider: azure，同样添加上述两个参数即可解决问题。

修改配置后重启oauth2-proxy，重新登录后，日志中的user字段会变为邮箱或PreferredUsername，应用也能获取到预期的用户标识值。

内容的提问来源于stack exchange，提问作者js-jp