@@ -650,7 +650,7 @@ func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {
650650 }
651651 http.Redirect(rw, req, redirect, 302)
652652 } else {
653− logger.PrintAuthf(session.Email, req, logger.AuthSuccess, "Invalid authentication via OAuth2: unauthorized")
653+ logger.PrintAuthf(session.Email, req, logger.AuthFailure, "Invalid authentication via OAuth2: unauthorized")
654654 p.ErrorPage(rw, 403, "Permission Denied", "Invalid Account")
655655 }
656656}
@@ -759,11 +759,13 @@ func (p *OAuthProxy) getAuthenticatedSession(rw http.ResponseWriter, req *http.R
759759 }
760760 }
761761
762− if session != nil && session.Email != "" && !p.Validator(session.Email) {
763− logger.Printf(session.Email, req, logger.AuthFailure, "Invalid authentication via session: removing session %s", session)
764− session = nil
765− saveSession = false
766− clearSession = true
762+ if session != nil && session.Email != "" {
763+ if !p.Validator(session.Email) || !p.provider.ValidateGroup(session.Email) {
764+ logger.Printf(session.Email, req, logger.AuthFailure, "Invalid authentication via session: removing session %s", session)
765+ session = nil
766+ saveSession = false
767+ clearSession = true
768+ }
767769 }
768770
769771 if saveSession && session != nil {