<p>I have a problem with authentication kubernetes webapp via oauth2-proxy/keycloak. You don't know what's wrong</p>
<ul>
<li>Webapp (test-app.domain.com)</li>
<li>oauth2-proxy (oauth2-proxy.domain.com)</li>
<li>keycloak (keycloak-test.domain.com)</li>
</ul>
<p>Those three app runs separately.</p>
<p><strong>description of the authentication procedure:</strong></p>
<p>After open <strong>test.domain.com</strong> is redirected to <a href="https://keycloak-test.domain.com/auth/realms/local/protocol/openid-connect/auth?approval_prompt=force&amp;client_id=k8s2&amp;redirect_uri=https%3A%2F%2Foauth2-proxy.domain.com%2Foauth2%2Fcallback&amp;response_type=code&amp;scope=openid+profile+email+users&amp;state=7a6504626c89d85dad9337f57072d7e4%3Ahttps%3A%2F%2Ftest-app%2F" rel="noreferrer">https://keycloak-test.domain.com/auth/realms/local/protocol/openid-connect/auth?approval_prompt=force&amp;client_id=k8s2&amp;redirect_uri=https%3A%2F%2Foauth2-proxy.domain.com%2Foauth2%2Fcallback&amp;response_type=code&amp;scope=openid+profile+email+users&amp;state=7a6504626c89d85dad9337f57072d7e4%3Ahttps%3A%2F%2Ftest-app%2F</a></p>
<p>Keycloak login page is displayed correctly but after user login I get: 500 Internal Server Error  with URL <a href="https://oauth2-proxy.domain.com/oauth2/callback?state=753caa3a281921a02b97d3efeabe7adf%3Ahttps%3A%2F%2Ftest-app.domain.com%2F&amp;session_state=f5d45a13-5383-4a79-aa7a-56bbaa16056f&amp;code=5344ae72-a9ee-448f-95ef-45e413f69f4b.f5d45a13-5383-4a79-aa7a-56bbaa16056f.78732ee5-af17-43fc-9f52-856e06bfce04" rel="noreferrer">https://oauth2-proxy.domain.com/oauth2/callback?state=753caa3a281921a02b97d3efeabe7adf%3Ahttps%3A%2F%2Ftest-app.domain.com%2F&amp;session_state=f5d45a13-5383-4a79-aa7a-56bbaa16056f&amp;code=5344ae72-a9ee-448f-95ef-45e413f69f4b.f5d45a13-5383-4a79-aa7a-56bbaa16056f.78732ee5-af17-43fc-9f52-856e06bfce04</a></p>
<p><strong>LOG from oauth2-proxy</strong></p>
<pre><code>[2021/03/16 11:25:35] [stored_session.go:76] Error loading cookied session: cookie &quot;_oauth2_proxy&quot; not present, removing session
10.30.21.14:35382 - - [2021/03/16 11:25:35] oauth2-proxy.domain.com GET - &quot;/oauth2/auth&quot; HTTP/1.1 &quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Safari/605.1.15&quot; 401 13 0.000
10.96.5.198:35502 - - [2021/03/16 11:25:35] oauth2-proxy.domain.com GET - &quot;/oauth2/start?rd=https://test-app.domain.com/&quot; HTTP/1.1 &quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Safari/605.1.15&quot; 302 400 0.000
[2021/03/16 11:25:39] [oauthproxy.go:753] Error redeeming code during OAuth2 callback: email in id_token (user1@user.com) isn't verified
10.96.5.198:35502 - - [2021/03/16 11:25:39] oauth2-proxy.domain.com GET - &quot;/oauth2/callback?state=1fe22deb33ce4dc7e316f23927b8d821%3Ahttps%3A%2F%2Ftest-app.domain.com%2F&amp;session_state=c69d7a8f-32f2-4a84-a6af-41b7d2391561&amp;code=4759cce8-1c1c-4da3-ba94-9987c2ce3e02.c69d7a8f-32f2-4a84-a6af-41b7d2391561.78732ee5-af17-43fc-9f52-856e06bfce04&quot; HTTP/1.1 &quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Safari/605.1.15&quot; 500 345 0.030
</code></pre>
<p><strong>test-app ingress</strong></p>
<pre><code>    apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/auth-url: &quot;oauth2-proxy.domain.com/oauth2/auth&quot;
    nginx.ingress.kubernetes.io/auth-signin: &quot;oauth2-proxy.domain.com/oauth2/start?rd=$scheme://$best_http_host$request_uri&quot;
    nginx.ingress.kubernetes.io/auth-response-headers: &quot;x-auth-request-user, x-auth-request-email, x-auth-request-access-token&quot;
    nginx.ingress.kubernetes.io/proxy-buffer-size: &quot;16k&quot;
  name: test-app
  namespace: its
spec:
  rules:
    - host: test-app.domain.com
      http:
        paths:
          - path: /
            backend:
              serviceName: test-app
              servicePort: http

  tls:
    - hosts:
      - test-app.domain.com
      secretName: cert-wild.test-proxy.domain.com
</code></pre>
<p><strong>oauth2-proxy config and ingress</strong></p>
<pre><code> containers:
      - name: oauth2-proxy
        image: quay.io/oauth2-proxy/oauth2-proxy:latest
        ports:
        - containerPort: 8091
        args:
        - --provider=oidc
        - --client-id=k8s2
        - --client-secret=Sd28cf1-1e14-4db1-8ed1-5ba64e1cd421
        - --cookie-secret=x-1vrrMhC-886ITuz8ySNw==
        - --oidc-issuer-url=https://keycloak-test.domain.com/auth/realms/local
        - --email-domain=*
        - --scope=openid profile email users
        - --cookie-domain=.domain.com
        - --whitelist-domain=.domain.com
        - --pass-authorization-header=true
        - --pass-access-token=true
        - --pass-user-headers=true
        - --set-authorization-header=true
        - --set-xauthrequest=true
        - --cookie-refresh=1m
        - --cookie-expire=30m
        - --http-address=0.0.0.0:8091
---
apiVersion: v1
kind: Service
metadata:
  name: oauth2-proxy
  labels:
    name: oauth2-proxy
spec:
  ports:
  - name: http
    port: 8091
    targetPort: 8091
  selector:
    name: oauth2-proxy
---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/proxy-buffer-size: &quot;16k&quot;
  name: oauth2-proxy
  namespace: its
spec:
  rules:
    - host: oauth2-proxy.domain.com
      http:
        paths:
          - path: /oauth2
            backend:
              serviceName: oauth2-proxy
              servicePort: 8091
  tls:
    - hosts:
      - oauth2-proxy.domain.com
      secretName: cert-wild.oauth2-proxy.domain.com
</code></pre>

<p>You can try setting --insecure-oidc-allow-unverified-email in your oauth2-proxy configuration.
Alternatively, in keycloak, mark user email verified in user settings..</p>
