Auth0 restricting users

[michalchecinski]

Hey @billimek 😃
Firstly, I wanted to thank you for this repo! Your work is very helpful for me when setting up my kubernetes stack at home!
I'm setting up the same setup for auth that you have: oauth2-proxy with Auth0. I cannot find that setting on oauth2-proxy or Auth0 when using an external identity provider (github in my case). Can you guide me on how you restricted access there for only certain users/email addresses?

[billimek]

Hi @michalchecinski , it's been a little while since I originally configured this but I believe this may help.

In my case, on auth0, I leverage the microsoft "Windows Live' 'social' connection, as seen below (previously used the Google "Google / Gmail" social connection too for my Google Workspaces domain, similar setup):

And then in the Auth0 "Auth Pipeline" -> "Rules" section, I have a script that will only allow email addresses belonging to certain domains to pass. You could probably modify the script to only allow certain specific email addresses instead of the entire domain/domains:

function emailDomainWhitelist(user, context, callback) {
  // Access should only be granted to verified users.
  if (!user.email || !user.email_verified) {
    return callback(new UnauthorizedError('Access denied.'));
  }

  const whitelist = ['billimek.com', 'eviljungle.com']; //authorized domains
  const userHasAccess = whitelist.some(function (domain) {
    const emailSplit = user.email.split('@');
    return emailSplit[emailSplit.length - 1].toLowerCase() === domain;
  });

  if (!userHasAccess) {
    return callback(new UnauthorizedError('Access denied.'));
  }

  return callback(null, user, context);
}