[Bug]: Bearer token from `extra_jwt_issuers` does not respect `insecure_oidc_allow_unverified_email`

OAuth2-Proxy Version

7.8.2

Provider

keycloak-oidc

Expected Behaviour

Bearer token should be accepted when insecure_oidc_allow_unverified_email = true if the iss is included in the extra_jwt_issuers field and email_verified: False

Current Behaviour

When using OAuth2 Proxy with JWT bearer tokens, there's inconsistent behavior between tokens from the main OIDC issuer vs. tokens from extra_jwt_issuers

1. When oidc_issuer_url matches the token's iss claim:

   • Tokens with email_verified: false are accepted if insecure_oidc_allow_unverified_email = true.
   • ✅ The configuration flag functions as intended.

{
  "iss": "https://keycloak.com/realms/dune",
  "aud": ["example_aud", "not_dune", "dune"],
  "typ": "ID",
  "azp": "some-client-id",
  "preferred_username": "service-account-tester
  "email_verified": false
}

1. When the token's iss claim is listed under extra_jwt_issuers:

   • Tokens with email_verified: false are rejected with the following error:

     复制

     email in id_token (24b3d099-31e4-47bb-9839-64adef09b4ae) isn't verified

   • ❌ The insecure_oidc_allow_unverified_email flag has no effect in this case.

{
  "iss": "https://keycloak.com/realms/not_dune",
  "aud": ["example_aud", "not_dune", "dune"],
  "typ": "ID",
  "azp": "my-client-id",
  "preferred_username": "service-account-my-client-id",
  "email_verified": false
}

Steps To Reproduce

1. Configure OAuth2 Proxy with:

   复制

   skip_jwt_bearer_tokens = true
   oidc_issuer_url = https://keycloak.com/auth/realms/not_dune
   insecure_oidc_allow_unverified_email = true
   insecure_oidc_skip_issuer_verification = true
   extra_jwt_issuers = https://keycloak.com/auth/realms/dune=example_aud

2. Submit a request with a JWT bearer token from the extra issuer that has email_verified: false and no email key present.

3. Observe the error: email in id_token (24b3d099-31e4-47bb-9839-64adef09b4ae) isn't verified

Possible Solutions

Modify CreateTokenToSessionFunc to accept and respect the insecure_oidc_allow_unverified_email setting. Looking at buildSessionFromClaims where it does respect the field:

verifyEmail := (p.EmailClaim == options.OIDCEmailClaim) && !p.AllowUnverifiedEmail

Configuration details or additional information

      provider = "keycloak-oidc"
      email_domains = "*"
      upstreams = [ "http://nginx-proxy-srv:8080" ]
      redirect_url = "https://example.com/oauth2/callback"
      pass_access_token = true
      pass_authorization_header = true
      pass_user_headers = true
      skip_jwt_bearer_tokens = true
      insecure_oidc_allow_unverified_email = true
      insecure_oidc_skip_issuer_verification = true
      code_challenge_method = "S256"
      cookie_name = "__Secure-oauth2_proxy"
      cookie_refresh = "60s"
      cookie_samesite = "none"
      skip_provider_button = true
      oidc_issuer_url = "https://keycloak.com/auth/realms/dune"
      silence_ping_logging = true
      skip_auth_routes = [ "/utils/health", "/healthz" ]
      metrics_address = "0.0.0.0:9100"
      extra_jwt_issuers= "https://keycloak.com/auth/realms/not_dune=example_aud"