authenticated-emails-file not properly checked with google apps domain about oauth2_proxy HOT 4 CLOSED

I might be reading the code wrong, but from the looks of it, the validator function only checks that the domain for each user in authenticated-emails-file matches the google apps domain. Is this intended?

I'm looking to restrict access to a particular group/suborg.

from oauth2_proxy.

@groob I think you are running into just poor documentation here. The --google-apps-domain option is intended to whitelist a whole email domain. I've been considering renaming it to something like --whitelist-email-domain to make that clearer (not to mention oauth2_proxy applies that value for any provider not just google)

If you want to just validate w/ a list of emails you should be fine just skipping the domain in google-apps-domain.

from oauth2_proxy.

Thank you for clearing that up!

I actually added the -google-apps-domain flag because I kept getting 'Invalid Account'. Did not realize that the -authenticated-emails-file was necessary.

from oauth2_proxy.

you should be able to use either. Were you getting an error using just --authenticated-emails-file ?

from oauth2_proxy.