[🐛 Bug]: incorrect username in UI oauth2proxy

[dudename]

Describe the bug
When using AUTH_TYPE=OAUTH2PROXY, the UI displays the default user "Keep" and highlights "Keep" in the tab settings?selectedTab=users&userSubTab=users, instead of showing the actual logged-in user from OAuth2Proxy.

The /api/auth/session endpoint returns a response for AuthType.NOAUTH (as defined in keep-ui/auth.config.ts):

{
  "user": {
    "name": "Keep",
    "email": "keep",
    "accessToken": "{\"tenant_id\":\"keep\",\"user_id\":\"keep-user-for-no-auth-purposes\"}",
    "tenantId": "keep",
    "role": "user",
    "tenantIds": [
      {
        "tenant_id": "keep",
        "tenant_name": "Tenant of Keep (tenant_id: keep)"
      },
      {
        "tenant_id": "keep2",
        "tenant_name": "Tenant of another Keep (tenant_id: keep2)"
      }
    ]
  },
  "expires": "2026-01-10T09:01:19.626Z",
  "accessToken": "{\"tenant_id\":\"keep\",\"user_id\":\"keep-user-for-no-auth-purposes\"}",
  "tenantId": "keep",
  "userRole": "user"
}

To Reproduce
Steps to reproduce the behavior:

1. Set up KeepHQ works with oauth2proxy
2. Configure environment variables: KEEP_OAUTH2_PROXY*
3. Sign in to KeepHQ via OAuth2Proxy
4. Check the current user in the UI’s main tab and in settings?selectedTab=users&userSubTab=users

Expected behavior
The UI should display the actual logged-in user from OAuth2Proxy — the one created in the database by the backend.

Screenshots

Additional context
Add any other context about the problem here.

[dosubot]

Hi @dudename! I'm Dosu and I’m helping the keep team.

This usually means the backend isn’t receiving the expected user identity headers from OAuth2Proxy, or the frontend wasn’t built with the correct environment variables. When AUTH_TYPE=OAUTH2PROXY is set, the backend expects headers like x-forwarded-email (or whatever you set as KEEP_OAUTH2_PROXY_USER_HEADER) and x-forwarded-groups (KEEP_OAUTH2_PROXY_ROLE_HEADER) to be present on every request. If these are missing, the backend either returns a 401 or falls back to default/NOAUTH user data, which is why you see "Keep" in the UI instead of the actual user docs issue.

Common causes:

• The ingress/proxy isn’t forwarding the auth headers to the backend. Double-check your nginx or ingress annotations: you need nginx.ingress.kubernetes.io/auth-response-headers to include the relevant headers (e.g., x-auth-request-email, x-forwarded-email) docs.
• The frontend was built without NEXT_PUBLIC_AUTH_TYPE=OAUTH2PROXY at build time. If this is missing, the UI falls back to AuthJS mode and will show the default user discussion.
• The backend and frontend must both have the correct KEEP_OAUTH2_PROXY_USER_HEADER and KEEP_OAUTH2_PROXY_ROLE_HEADER set, matching what your proxy is forwarding.

Troubleshooting checklist:

1. Confirm the frontend image was rebuilt after setting NEXT_PUBLIC_AUTH_TYPE=OAUTH2PROXY.
2. Ensure your ingress/proxy is forwarding the correct headers to the backend.
3. Check that KEEP_OAUTH2_PROXY_USER_HEADER and KEEP_OAUTH2_PROXY_ROLE_HEADER are set on both frontend and backend, and match the actual header names being sent.
4. If you’re still seeing the default user, enable backend logging for request headers (LOG_AUTH_PAYLOAD=true) to verify what headers are actually received.

If the user’s name is missing from the headers, the UI will default to "Keep" as the display name and show "KE" as initials issue. Make sure your OAuth2Proxy and identity provider are passing a name or email field as expected.

Recent changes also mean you should use the new KEEP_OAUTH2_PROXY_ADMIN_ROLES, KEEP_OAUTH2_PROXY_NOC_ROLES, and KEEP_OAUTH2_PROXY_WEBHOOK_ROLES env vars for role mapping PR.

If you follow these steps and headers are set up correctly, the UI should show the actual logged-in user from OAuth2Proxy.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}