Overriding X-Authentik-Email at group level only works randomly

[pelaxa]

Dear Authentik community,

I am using Authentik and FireFlyIII setup for a while and working flawlessly until a few months ago.

To provide access for me and significant other for the same FireFly account, I used a group, and used the attributes of the group to provide additionalHeaders and override the X-Authentik-Email header so that we both use the same fixed value and get access.

Now it seems that it is working randomly where in the middle of my session in FireFly, the X-Authentik-Email header is sometimes set correctly to the common email and sometimes to my email. I ignored it for a while but it is getting very annoying now and I cannot figure out what can cause this.

I have the following setup:

• Everything is running in as docker containers
• I have nginx-proxy fronting everything
• I have setup Authentik app and proxy provider for Firefly
• FireFly is expecting X-Authentik-Email for authentication to know which account to show.

I did a pcap and can see that X-Authentik-Email is always sent but the value is randomly switching between my email and the common email.

Obviously, all three components have updated in the past few months but based on the fact that the header is always sent but with bad value, I have to think this is either an Authentik issue or somehow the proxy is caching it????

Like I said, this was all working flawlessly a few months back and i have not changed configuration.
Any help would be appreciated.

[pelaxa]

For anyone else that may run into a similar issue

Using the group attribute override just did not seem to work reliably no matter what I tried.

I ended up creating a custom property mapping (Scope Mapping) and adding that as a scope of the provider using a new header instead of trying to override Authentil's X-Authentik-Email header and it seems to work much better. Even this did not really work until I restarted AUthentik. YMMV.

# Check if user is in a specific group
user_email = request.user.email
for group in request.user.ak_groups.all():
    if group.name == "<my special group>":
        user_email = "<common email>"
        break

# Default behavior for everyone else
return {
    "ak_proxy": {
        "user_attributes": {
            "additionalHeaders": {
                "X-FIREFLY-EMAIL": user_email
            }
        }
    }
}