Repository: goauthentik/authentik

Issue:
Authentik Outpost Proxy Bad Gateway error when sign_out
**Describe the bug**
I get a 502 "Bad gateway" error (and a go stacktrace) when I go on outpost sign_out url

**To Reproduce**
1. Set up a authentik outpost proxy
2. Configure your app to login with a traefik forwardAuth middleware
3. Login with success
4. Got to the signout url `https://svc.my_domain.tld/outpost.goauthentik.io/sign_out`
5. See error 502 "Bad Gateway"
6. In the log `http: panic serving 172.18.0.2:36148: interface conversion: interface {} is nil, not application.Claims`

**Expected behavior**
A successful Authentik/App logout 

**Screenshots**
N/A

**Logs**
```
authentik-proxy-1  | 2023/05/04 10:58:37 http: panic serving 172.18.0.2:36148: interface conversion: interface {} is nil, not application.Claims                                                                                            
authentik-proxy-1  | goroutine 38672 [running]:                                                                                                                                                                                             
authentik-proxy-1  | net/http.(*conn).serve.func1()                                                                                                                                                                                         
authentik-proxy-1  |    /usr/local/go/src/net/http/server.go:1854 +0xbf                                                                                                                                                                     
authentik-proxy-1  | panic({0x1029280, 0xc0007e0930})                                                                                                                                                                                       
authentik-proxy-1  |    /usr/local/go/src/runtime/panic.go:890 +0x263                                                                                                                                                                       
authentik-proxy-1  | goauthentik.io/internal/outpost/proxyv2/application.(*Application).Logout(0xc000208700, {0xc0006ff6c0, 0x40})                                                                                                          
authentik-proxy-1  |    /go/src/goauthentik.io/internal/outpost/proxyv2/application/session.go:97 +0x169d                                                                                                                                   
authentik-proxy-1  | goauthentik.io/internal/outpost/proxyv2/application.(*Application).handleSignOut(0xc000208700, {0x12cea40, 0xc00039b460}, 0xc00043b480?)                                                                               
authentik-proxy-1  |    /go/src/goauthentik.io/internal/outpost/proxyv2/application/application.go:274 +0x297                                                                                                                               
authentik-proxy-1  | net/http.HandlerFunc.ServeHTTP(0x0?, {0x12cea40?, 0xc00039b460?}, 0x12?)                                                                                                                                               
authentik-proxy-1  |    /usr/local/go/src/net/http/server.go:2122 +0x2f                                                                                                                                                                     
authentik-proxy-1  | goauthentik.io/internal/outpost/proxyv2/application.NewApplication.func3.1({0x12cea40, 0xc00039b460}, 0xc0007b6f00)                                                                                                    
authentik-proxy-1  |    /go/src/goauthentik.io/internal/outpost/proxyv2/application/application.go:187 +0x1f9                                                                                                                               
authentik-proxy-1  | net/http.HandlerFunc.ServeHTTP(0xc0006ff6c0?, {0x12cea40?, 0xc00039b460?}, 0x0?)                                                                                                                                       
authentik-proxy-1  |    /usr/local/go/src/net/http/server.go:2122 +0x2f                                                                                                                                                                     
authentik-proxy-1  | goauthentik.io/internal/outpost/proxyv2/application.NewApplication.func2.1({0x12cea40, 0xc00039b460}, 0xc0007b6f00)                                                                                                    
authentik-proxy-1  |    /go/src/goauthentik.io/internal/outpost/proxyv2/application/application.go:165 +0x222                                                                                                                               
authentik-proxy-1  | net/http.HandlerFunc.ServeHTTP(0xc0008c6d20?, {0x12cea40?, 0xc00039b460?}, 0x0?)                                                                                                                                       
authentik-proxy-1  |    /usr/local/go/src/net/http/server.go:2122 +0x2f                                                                                                                                                                     
authentik-proxy-1  | goauthentik.io/internal/utils/web.loggingHandler.ServeHTTP({{0x12cb9e0?, 0xc00039b420?}, 0xc00016f2d0?, 0xc0001256d0?}, {0x12cee30?, 0xc000482fc0}, 0xc0007b6f00)                                                      
authentik-proxy-1  |    /go/src/goauthentik.io/internal/utils/web/middleware.go:98 +0x12c                                                                                                                                                   
authentik-proxy-1  | github.com/gorilla/mux.(*Router).ServeHTTP(0xc000000300, {0x12cee30, 0xc000482fc0}, 0xc0007b6d00)                                                                                                                      
authentik-proxy-1  |    /go/pkg/mod/github.com/gorilla/mux@v1.8.0/mux.go:210 +0x1cf                                                                                                                                                         
authentik-proxy-1  | goauthentik.io/internal/outpost/proxyv2/application.(*Application).ServeHTTP(...)                                                                                                                                      
authentik-proxy-1  |    /go/src/goauthentik.io/internal/outpost/proxyv2/application/application.go:250                                                                                                                                      
authentik-proxy-1  | goauthentik.io/internal/outpost/proxyv2.(*ProxyServer).Handle(0xc00021c370, {0x12cee30, 0xc000482fc0}, 0xc0007b6d00)                                                                                                   
authentik-proxy-1  |    /go/src/goauthentik.io/internal/outpost/proxyv2/handlers.go:129 +0xa25                                                                                                                                              
authentik-proxy-1  | net/http.HandlerFunc.ServeHTTP(0x1136b00?, {0x12cee30?, 0xc000482fc0?}, 0x7f59d0?)                                                                                                                                     
authentik-proxy-1  |    /usr/local/go/src/net/http/server.go:2122 +0x2f                                                                                                                                                                     
authentik-proxy-1  | goauthentik.io/internal/outpost/proxyv2.NewProxyServer.func1.1({0x12cee30, 0xc000482fc0}, 0xc0003b9260?)                                                                                                               
authentik-proxy-1  |    /go/src/goauthentik.io/internal/outpost/proxyv2/proxyv2.go:46 +0x3c                           
authentik-proxy-1  | net/http.HandlerFunc.ServeHTTP(0xc0007b6c00?, {0x12cee30?, 0xc000482fc0?}, 0xc0008c79e8?)                                                                                                                              
authentik-proxy-1  |    /usr/local/go/src/net/http/server.go:2122 +0x2f                                               
authentik-proxy-1  | github.com/gorilla/mux.(*Router).ServeHTTP(0xc000000000, {0x12cee30, 0xc000482fc0}, 0xc0007b6b00)                                                                                                                      
authentik-proxy-1  |    /go/pkg/mod/github.com/gorilla/mux@v1.8.0/mux.go:210 +0x1cf                                   
authentik-proxy-1  | net/http.serverHandler.ServeHTTP({0xc0008cae40?}, {0x12cee30, 0xc000482fc0}, 0xc0007b6b00)                                                                                                                             
authentik-proxy-1  |    /usr/local/go/src/net/http/server.go:2936 +0x316                                              
authentik-proxy-1  | net/http.(*conn).serve(0xc00012efc0, {0x12cf600, 0xc0001998c0})                                  
authentik-proxy-1  |    /usr/local/go/src/net/http/server.go:1995 +0x612                                              
authentik-proxy-1  | created by net/http.(*Server).Serve                                                              
authentik-proxy-1  |    /usr/local/go/src/net/http/server.go:3089 +0x5ed
```                                       
**Version and Deployment (please complete the following information):**

-   authentik version: 2023.4.1
-   Deployment: docker-compose

**Additional context**
The login works fine.



Discussion:

Resolving patch:
diff --git a/authentik/providers/oauth2/migrations/0016_alter_refreshtoken_token.py b/authentik/providers/oauth2/migrations/0016_alter_refreshtoken_token.py
--- a/authentik/providers/oauth2/migrations/0016_alter_refreshtoken_token.py
+++ b/authentik/providers/oauth2/migrations/0016_alter_refreshtoken_token.py
@@ -21,4 +21,26 @@ class Migration(migrations.Migration):
                 default=authentik.providers.oauth2.models.generate_client_secret
             ),
         ),
+        migrations.AlterField(
+            model_name="oauth2provider",
+            name="sub_mode",
+            field=models.TextField(
+                choices=[
+                    ("hashed_user_id", "Based on the Hashed User ID"),
+                    ("user_id", "Based on user ID"),
+                    ("user_uuid", "Based on user UUID"),
+                    ("user_username", "Based on the username"),
+                    (
+                        "user_email",
+                        "Based on the User's Email. This is recommended over the UPN method.",
+                    ),
+                    (
+                        "user_upn",
+                        "Based on the User's UPN, only works if user has a 'upn' attribute set. Use this method only if you have different UPN and Mail domains.",
+                    ),
+                ],
+                default="hashed_user_id",
+                help_text="Configure what data should be used as unique User Identifier. For most cases, the default should be fine.",
+            ),
+        ),
     ]


Test patch: