<p>I am running a Kubernetes Cluster with an Nginx-ingress fronting couple of web apps. Because Nginx doesn't support SSO/OIDC by default, I use an oauth_proxy for authentication.</p>

<p>Everything is working, only verified users are able to access the web pages. </p>

<p>Is it possible to pass or request information from the Identity Provider to the client?</p>

<h3>Edit</h3>

<p>I already use oauth2_proxy (<a href="https://github.com/pusher/oauth2_proxy" rel="nofollow noreferrer">https://github.com/pusher/oauth2_proxy</a>) with Azure AD. The issue is that I need all user details from the IP.</p>

<p>Logs from my oauth2_proxy:</p>

<pre><code>$ kubectl logs oauth2-proxy-7ddc97f9d5-ckm29
[oauthproxy.go:846] Error loading cookied session: Cookie "_oauth2_proxy" not present
...
[requests.go:25] 200 GET https://graph.windows.net/me?api-version=1.6 {
  "odata.metadata":"https://graph.windows.net/myorganization/$metadata#directoryObjects/@Element",
  "odata.type":"Microsoft.DirectoryServices.User",
  "objectType":"User", 
  ... ,
  "sipProxyAddress":"nico.schuck@example.com",
  "streetAddress":"my stree",
  "surname":"Schuck",
  "telephoneNumber":55512345,
  "usageLocation":"DE",
  "userType":"Member"
}
165.xxx.xxx.214 - nico.schuck@example.com [2020/01/17 11:22:02] [AuthSuccess] Authenticated via OAuth2: Session{email:nico.schuck@example.com user: token:true id_token:true created:2020-01-17 11:22:02.28839851 +0000 UTC m=+181.592452463 expires:2020-01-17 12:22:02 +0000 UTC refresh_token:true}
</code></pre>

Nico Schuck
<p>Consider oauth2_proxy which works well with nginx ingress for SSO. Follow the below link</p>

<p><a href="https://github.com/bitly/oauth2_proxy" rel="nofollow noreferrer">https://github.com/bitly/oauth2_proxy</a></p>

<p>You should be using below configuration in your Ingress Rule</p>

<pre><code>metadata:
  name: application
  annotations:
    nginx.ingress.kubernetes.io/auth-url: "https://$host/oauth2/auth"
    nginx.ingress.kubernetes.io/auth-signin: "https://$host/oauth2/start?rd=$escaped_request_uri"
</code></pre>
