[Support]: How to use allowed_groups query parameter when groups themselves contain commas?

OAuth2-Proxy Version

7.15.3

Provider

oidc

Current Behaviour of your Problem

Hi, I'm using the oauth2-proxy helm chart 10.7.0 (appVersion 7.15.3) and already got it working with my idp and the allowed_emails query parameter. However, I would like to use the allowed_groups query parameter but am facing issues due to the format my idp returns the groups in.

A little bit about how I want to use oauth2-proxy: In my cluster, I use traefik as an ingress controller + reverse proxy and want to protect some endpoints with oauth2-proxy. Some endpoints should only be accessible for admins, some for team-a, some for team-b and so on. I want to achieve this via the allowed_groups setting.

For the deployment of oauth2-proxy, I have two options. Either a single central instance or multiple instances (one per team/group). For the single instance, I'd deploy multiple traefik middlewares where each middleware has a different allowed_groups query parameter. Then, I'd just annotate each ingress with the respective middleware according to the group I want to give access to. For the multi-instance option, I'd remove the allowed_groups from the query parameters in the middleware and move it into each of the instance's toml config files instead.

I personally prefer the single instance approach with allowed_groups in the query parameters. To me, multiple middlewares are less baggage to carry than multiple oauth2-proxy deployments. And this is where my problem arises.

My idp returns the groups of a user in LDAP Bind-DN format. So:

# These are three groups.
"groups":[
"cn=admins,ou=dev,ou=apps,o=global",
"cn=team-a,ou=dev,ou=apps,o=global",
"cn=team-b,ou=dev,ou=apps,o=global"
]

And now I hope you already see the problem. When I define my traefik middleware like this:

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: auth-group-admins
  namespace: traefik
spec:
  forwardAuth:
    address: "http://oauth2-proxy.oauth2-proxy.svc.cluster.local:80/oauth2/auth?allowed_groups=cn%3admins%2Cou%3Ddev%2Cou%3Dapps%2Co%3Dglobal"
    # or like this
    # address: "http://oauth2-proxy.oauth2-proxy.svc.cluster.local:80/oauth2/auth?allowed_groups=cn=admins,ou=dev,ou=apps,o=global"    
    trustForwardHeader: true
    authResponseHeaders:
      - "X-Auth-Request-User"
      - "X-Auth-Request-Email"

The single group cn=admins,ou=dev,ou=apps,o=global is interpreted as four groups because (as the documentation states) the parameter expects a comma separated string.

This puts me into a awkward situation. I know that configuring the allowed groups in the config file, like

# ...
allowed_groups = ["cn=admins,ou=dev,ou=apps,o=global"]
# ...

works. However, I would really like to use the query parameter for the reasons stated above.

This function checks the allowed_groups: https://github.com/oauth2-proxy/oauth2-proxy/blob/66b3a17db09f0b51a4bc3159d4c7fe3fbeca1288/oauthproxy.go#L1243-L1258 This function parses the URL parameters: https://github.com/oauth2-proxy/oauth2-proxy/blob/66b3a17db09f0b51a4bc3159d4c7fe3fbeca1288/oauthproxy.go#L1201-L1217

I wasn't able to find how the parameter gets loaded from the toml but there the parsing seems to be different.

I found an old PR where waaaay back there was a somewhat related issue that dealt with these type of groups but in another context (X-Forwareded-Groups header). https://github.com/oauth2-proxy/oauth2-proxy/pull/799

So, my questions are:

• Is there any way to use groups in my format in the query parameters?
• Is there any way to escape the commas in the query parameter?
• Would it be sane to change extractAllowedEntities in a way that allows escaping of commas?

Configuration details or additional information

# snippet from the k8s deployment
      containers:
        - args:
            - '--http-address=0.0.0.0:4180'
            - '--https-address=0.0.0.0:4443'
            - '--metrics-address=0.0.0.0:44180'
            - '--config=/etc/oauth2_proxy/oauth2_proxy.cfg'
          env:
            - name: OAUTH2_PROXY_OIDC_ISSUER_URL
              valueFrom:
                secretKeyRef:
                  key: issuer-url
                  name: oauth-secret
            - name: OAUTH2_PROXY_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  key: client-id
                  name: oauth-secret
            - name: OAUTH2_PROXY_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  key: client-secret
                  name: oauth-secret
            - name: OAUTH2_PROXY_COOKIE_SECRET
              valueFrom:
                secretKeyRef:
                  key: cookie-secret
                  name: oauth2-proxy-cookie-secret

# snippet from the config
oauth2_proxy.cfg:
    upstreams = ["file:///dev/null"]
    email_domains = ["mydomain.tld"]
    silence_ping_logging = true
    code_challenge_method = "S256"
    trusted_proxy_ips = ["100.64.0.0/10"]
    session_cookie_minimal = true
    cookie_secure = true
    provider = "oidc"
    redirect_url =
    "https://oauth2proxy.mydomain.tld/oauth2/callback"
    whitelist_domains = [".mydomain.tld"]
    set_xauthrequest = true
    scope = "openid"
    oidc_groups_claim = "groups"
    oidc_email_claim = "email"
    cookie_domains = [ ".mydomain.tld" ]
    cookie_samesite = "lax"
    skip_provider_button = true
    reverse_proxy = true
    approval_prompt = "auto"
    use_system_trust_store = true
    provider_ca_files = ["/etc/ssl/certs/ca-bundle.crt"]

Steps To Reproduce

No response