<p>I'm using Azure B2C for authenticate my users. For authentication piece I have oauth2-proxy running in kubernetes cluster. Oauth2-Proxy is running behind ingress-nginx and it's passing most of required headers but I do not get X-Auth-Request-Groups header in my upstream service that is behind oauth2-proxy.</p>
<p>Here is my token that I get from B2C:</p>
<pre><code>{
 &quot;typ&quot;: &quot;JWT&quot;,
&quot;alg&quot;: &quot;RS256&quot;,
&quot;kid&quot;: &quot;kid_value&quot;
}.{
    &quot;exp&quot;: 1604420825,
    &quot;nbf&quot;: 1604417225,
    &quot;ver&quot;: &quot;1.0&quot;,
    &quot;iss&quot;: &quot;iss_value&quot;,
    &quot;sub&quot;: &quot;sub_value&quot;,
    &quot;aud&quot;: &quot;aud_value&quot;,
    &quot;acr&quot;: &quot;acr_name&quot;,
    &quot;nonce&quot;: &quot;defaultNonce&quot;,
    &quot;iat&quot;: 1604417225,
    &quot;auth_time&quot;: 1604417225,
    &quot;groups&quot;: [
        &quot;group1&quot;
     ],
     &quot;identityProviders&quot;: [
        &quot;email.com&quot;
      ],
    &quot;firstname&quot;: &quot;First Name&quot;,
    &quot;surname&quot;: &quot;Last Name&quot;,
    &quot;idp&quot;: &quot;IDP_VALUE&quot;,
    &quot;email&quot;: &quot;username@email.com&quot;,
    &quot;preferred_username&quot;: &quot;User Name&quot;
 }.[Signature]
</code></pre>
<p>And here are headers that I get in my upstream service after successful authentication:</p>
<pre><code>{
Accept: &quot;text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9&quot;,
Accept-Encoding: &quot;gzip, deflate, br&quot;,
Accept-Language: &quot;en-US,en;q=0.9&quot;,
Content-Length: &quot;0&quot;,
Cookie: &quot;COOKIE&quot;,
Sec-Fetch-Dest: &quot;document&quot;,
Sec-Fetch-Mode: &quot;navigate&quot;,
Sec-Fetch-Site: &quot;none&quot;,
Sec-Fetch-User: &quot;?1&quot;,
Upgrade-Insecure-Requests: &quot;1&quot;,
User-Agent: &quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36&quot;,
X-Auth-Request-Access-Token: &quot;ACCESS_TOKEN&quot;,
X-Auth-Request-Email: &quot;username@email.com&quot;,
X-Auth-Request-Preferred-Username: &quot;User Name&quot;,
X-Auth-Request-User: &quot;UserID&quot;,
X-B3-Parentspanid: &quot;Parentspanid&quot;,
X-B3-Sampled: &quot;0&quot;,
X-B3-Spanid: &quot;Spanid&quot;,
X-B3-Traceid: &quot;Traceid&quot;,
X-Envoy-Attempt-Count: &quot;1&quot;,
X-Forwarded-Client-Cert: &quot;CEERT&quot;,
X-Forwarded-For: &quot;Forwarded-For&quot;,
X-Forwarded-Host: &quot;Forwarded-Host&quot;,
X-Forwarded-Port: &quot;443&quot;,
X-Forwarded-Proto: &quot;https&quot;,
X-Real-Ip: &quot;Real-Ip&quot;,
X-Request-Id: &quot;Request-Id&quot;,
X-Scheme: &quot;https&quot;
}
</code></pre>
<p>all X-Auth-Request-* headers are coming but not the one with Groups. I'm using docker image <strong>quay.io/oauth2-proxy/oauth2-proxy:v6.1.1</strong> and I saw in config <a href="https://oauth2-proxy.github.io/oauth2-proxy/configuration" rel="nofollow noreferrer">https://oauth2-proxy.github.io/oauth2-proxy/configuration</a> option &quot;--oidc-groups-claim&quot; but when I try to use it container won't start because this option isn't available in this version.</p>
<p>Any ideas what I'm missing?</p>

<p>It seems that the problem is image that I'm using <strong>quay.io/oauth2-proxy/oauth2-proxy:v6.1.1</strong>, when I built own image from latest master (3rd of November 2020) everything seems to be working fine and X-Auth-Request-Groups header is passed to upstream service.</p>
