We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Authentik Outpost Proxy Bad Gateway error when sign_out
**Describe the bug**
I get a 502 "Bad gateway" error (and a go stacktrace) when I go on outpost sign_out url

**To Reproduce**
1. Set up a authentik outpost proxy
2. Configure your app to login with a traefik forwardAuth middleware
3. Login with success
4. Got to the signout url `https://svc.my_domain.tld/outpost.goauthentik.io/sign_out`
5. See error 502 "Bad Gateway"
6. In the log `http: panic serving 172.18.0.2:36148: interface conversion: interface {} is nil, not application.Claims`

**Expected behavior**
A successful Authentik/App logout 

**Screenshots**
N/A

**Logs**
```
authentik-proxy-1  | 2023/05/04 10:58:37 http: panic serving 172.18.0.2:36148: interface conversion: interface {} is nil, not application.Claims                                                                                            
authentik-proxy-1  | goroutine 38672 [running]:                                                                                                                                                                                             
authentik-proxy-1  | net/http.(*conn).serve.func1()                                                                                                                                                                                         
authentik-proxy-1  |    /usr/local/go/src/net/http/server.go:1854 +0xbf                                                                                                                                                                     
authentik-proxy-1  | panic({0x1029280, 0xc0007e0930})                                                                                                                                                                                       
authentik-proxy-1  |    /usr/local/go/src/runtime/panic.go:890 +0x263                                                                                                                                                                       
authentik-proxy-1  | goauthentik.io/internal/outpost/proxyv2/application.(*Application).Logout(0xc000208700, {0xc0006ff6c0, 0x40})                                                                                                          
authentik-proxy-1  |    /go/src/goauthentik.io/internal/outpost/proxyv2/application/session.go:97 +0x169d                                                                                                                                   
authentik-proxy-1  | goauthentik.io/internal/outpost/proxyv2/application.(*Application).handleSignOut(0xc000208700, {0x12cea40, 0xc00039b460}, 0xc00043b480?)                                                                               
authentik-proxy-1  |    /go/src/goauthentik.io/internal/outpost/proxyv2/application/application.go:274 +0x297                                                                                                                               
authentik-proxy-1  | net/http.HandlerFunc.ServeHTTP(0x0?, {0x12cea40?, 0xc00039b460?}, 0x12?)                                                                                                                                               
authentik-proxy-1  |    /usr/local/go/src/net/http/server.go:2122 +0x2f                                                                                                                                                                     
authentik-proxy-1  | goauthentik.io/internal/outpost/proxyv2/application.NewApplication.func3.1({0x12cea40, 0xc00039b460}, 0xc0007b6f00)                                                                                                    
authentik-proxy-1  |    /go/src/goauthentik.io/internal/outpost/proxyv2/application/application.go:187 +0x1f9                                                                                                                               
authentik-proxy-1  | net/http.HandlerFunc.ServeHTTP(0xc0006ff6c0?, {0x12cea40?, 0xc00039b460?}, 0x0?)                                                                                                                                       
authentik-proxy-1  |    /usr/local/go/src/net/http/server.go:2122 +0x2f                                                                                                                                                                     
authentik-proxy-1  | goauthentik.io/internal/outpost/proxyv2/application.NewApplication.func2.1({0x12cea40, 0xc00039b460}, 0xc0007b6f00)                                                                                                    
authentik-proxy-1  |    /go/src/goauthentik.io/internal/outpost/proxyv2/application/application.go:165 +0x222                                                                                                                               
authentik-proxy-1  | net/http.HandlerFunc.ServeHTTP(0xc0008c6d20?, {0x12cea40?, 0xc00039b460?}, 0x0?)                                                                                                                                       
authentik-proxy-1  |    /usr/local/go/src/net/http/server.go:2122 +0x2f                                                                                                                                                                     
authentik-proxy-1  | goauthentik.io/internal/utils/web.loggingHandler.ServeHTTP({{0x12cb9e0?, 0xc00039b420?}, 0xc00016f2d0?, 0xc0001256d0?}, {0x12cee30?, 0xc000482fc0}, 0xc0007b6f00)                                                      
authentik-proxy-1  |    /go/src/goauthentik.io/internal/utils/web/middleware.go:98 +0x12c                                                                                                                                                   
authentik-proxy-1  | github.com/gorilla/mux.(*Router).ServeHTTP(0xc000000300, {0x12cee30, 0xc000482fc0}, 0xc0007b6d00)                                                                                                                      
authentik-proxy-1  |    /go/pkg/mod/github.com/gorilla/mux@v1.8.0/mux.go:210 +0x1cf                                                                                                                                                         
authentik-proxy-1  | goauthentik.io/internal/outpost/proxyv2/application.(*Application).ServeHTTP(...)                                                                                                                                      
authentik-proxy-1  |    /go/src/goauthentik.io/internal/outpost/proxyv2/application/application.go:250                                                                                                                                      
authentik-proxy-1  | goauthentik.io/internal/outpost/proxyv2.(*ProxyServer).Handle(0xc00021c370, {0x12cee30, 0xc000482fc0}, 0xc0007b6d00)                                                                                                   
authentik-proxy-1  |    /go/src/goauthentik.io/internal/outpost/proxyv2/handlers.go:129 +0xa25                                                                                                                                              
authentik-proxy-1  | net/http.HandlerFunc.ServeHTTP(0x1136b00?, {0x12cee30?, 0xc000482fc0?}, 0x7f59d0?)                                                                                                                                     
authentik-proxy-1  |    /usr/local/go/src/net/http/server.go:2122 +0x2f                                                                                                                                                                     
authentik-proxy-1  | goauthentik.io/internal/outpost/proxyv2.NewProxyServer.func1.1({0x12cee30, 0xc000482fc0}, 0xc0003b9260?)                                                                                                               
authentik-proxy-1  |    /go/src/goauthentik.io/internal/outpost/proxyv2/proxyv2.go:46 +0x3c                           
authentik-proxy-1  | net/http.HandlerFunc.ServeHTTP(0xc0007b6c00?, {0x12cee30?, 0xc000482fc0?}, 0xc0008c79e8?)                                                                                                                              
authentik-proxy-1  |    /usr/local/go/src/net/http/server.go:2122 +0x2f                                               
authentik-proxy-1  | github.com/gorilla/mux.(*Router).ServeHTTP(0xc000000000, {0x12cee30, 0xc000482fc0}, 0xc0007b6b00)                                                                                                                      
authentik-proxy-1  |    /go/pkg/mod/github.com/gorilla/mux@v1.8.0/mux.go:210 +0x1cf                                   
authentik-proxy-1  | net/http.serverHandler.ServeHTTP({0xc0008cae40?}, {0x12cee30, 0xc000482fc0}, 0xc0007b6b00)                                                                                                                             
authentik-proxy-1  |    /usr/local/go/src/net/http/server.go:2936 +0x316                                              
authentik-proxy-1  | net/http.(*conn).serve(0xc00012efc0, {0x12cf600, 0xc0001998c0})                                  
authentik-proxy-1  |    /usr/local/go/src/net/http/server.go:1995 +0x612                                              
authentik-proxy-1  | created by net/http.(*Server).Serve                                                              
authentik-proxy-1  |    /usr/local/go/src/net/http/server.go:3089 +0x5ed
```                                       
**Version and Deployment (please complete the following information):**

-   authentik version: 2023.4.1
-   Deployment: docker-compose

**Additional context**
The login works fine.


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `authentik/providers/oauth2/migrations/0016_alter_refreshtoken_token.py`
Content:
```
1 # Generated by Django 4.1.7 on 2023-05-06 16:18
2 
3 from django.db import migrations, models
4 
5 import authentik.providers.oauth2.models
6 
7 
8 class Migration(migrations.Migration):
9     dependencies = [
10         (
11             "authentik_providers_oauth2",
12             "0015_accesstoken_auth_time_authorizationcode_auth_time_and_more",
13         ),
14     ]
15 
16     operations = [
17         migrations.AlterField(
18             model_name="refreshtoken",
19             name="token",
20             field=models.TextField(
21                 default=authentik.providers.oauth2.models.generate_client_secret
22             ),
23         ),
24     ]
25
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/authentik/providers/oauth2/migrations/0016_alter_refreshtoken_token.py b/authentik/providers/oauth2/migrations/0016_alter_refreshtoken_token.py
--- a/authentik/providers/oauth2/migrations/0016_alter_refreshtoken_token.py
+++ b/authentik/providers/oauth2/migrations/0016_alter_refreshtoken_token.py
@@ -21,4 +21,26 @@
                 default=authentik.providers.oauth2.models.generate_client_secret
             ),
         ),
+        migrations.AlterField(
+            model_name="oauth2provider",
+            name="sub_mode",
+            field=models.TextField(
+                choices=[
+                    ("hashed_user_id", "Based on the Hashed User ID"),
+                    ("user_id", "Based on user ID"),
+                    ("user_uuid", "Based on user UUID"),
+                    ("user_username", "Based on the username"),
+                    (
+                        "user_email",
+                        "Based on the User's Email. This is recommended over the UPN method.",
+                    ),
+                    (
+                        "user_upn",
+                        "Based on the User's UPN, only works if user has a 'upn' attribute set. Use this method only if you have different UPN and Mail domains.",
+                    ),
+                ],
+                default="hashed_user_id",
+                help_text="Configure what data should be used as unique User Identifier. For most cases, the default should be fine.",
+            ),
+        ),
     ]

{"golden_diff": "diff --git a/authentik/providers/oauth2/migrations/0016_alter_refreshtoken_token.py b/authentik/providers/oauth2/migrations/0016_alter_refreshtoken_token.py\n--- a/authentik/providers/oauth2/migrations/0016_alter_refreshtoken_token.py\n+++ b/authentik/providers/oauth2/migrations/0016_alter_refreshtoken_token.py\n@@ -21,4 +21,26 @@\n                 default=authentik.providers.oauth2.models.generate_client_secret\n             ),\n         ),\n+        migrations.AlterField(\n+            model_name=\"oauth2provider\",\n+            name=\"sub_mode\",\n+            field=models.TextField(\n+                choices=[\n+                    (\"hashed_user_id\", \"Based on the Hashed User ID\"),\n+                    (\"user_id\", \"Based on user ID\"),\n+                    (\"user_uuid\", \"Based on user UUID\"),\n+                    (\"user_username\", \"Based on the username\"),\n+                    (\n+                        \"user_email\",\n+                        \"Based on the User's Email. This is recommended over the UPN method.\",\n+                    ),\n+                    (\n+                        \"user_upn\",\n+                        \"Based on the User's UPN, only works if user has a 'upn' attribute set. Use this method only if you have different UPN and Mail domains.\",\n+                    ),\n+                ],\n+                default=\"hashed_user_id\",\n+                help_text=\"Configure what data should be used as unique User Identifier. For most cases, the default should be fine.\",\n+            ),\n+        ),\n     ]\n", "issue": "Authentik Outpost Proxy Bad Gateway error when sign_out\n**Describe the bug**\r\nI get a 502 \"Bad gateway\" error (and a go stacktrace) when I go on outpost sign_out url\r\n\r\n**To Reproduce**\r\n1. Set up a authentik outpost proxy\r\n2. Configure your app to login with a traefik forwardAuth middleware\r\n3. Login with success\r\n4. Got to the signout url `https://svc.my_domain.tld/outpost.goauthentik.io/sign_out`\r\n5. See error 502 \"Bad Gateway\"\r\n6. In the log `http: panic serving 172.18.0.2:36148: interface conversion: interface {} is nil, not application.Claims`\r\n\r\n**Expected behavior**\r\nA successful Authentik/App logout \r\n\r\n**Screenshots**\r\nN/A\r\n\r\n**Logs**\r\n```\r\nauthentik-proxy-1  | 2023/05/04 10:58:37 http: panic serving 172.18.0.2:36148: interface conversion: interface {} is nil, not application.Claims                                                                                            \r\nauthentik-proxy-1  | goroutine 38672 [running]:                                                                                                                                                                                             \r\nauthentik-proxy-1  | net/http.(*conn).serve.func1()                                                                                                                                                                                         \r\nauthentik-proxy-1  |    /usr/local/go/src/net/http/server.go:1854 +0xbf                                                                                                                                                                     \r\nauthentik-proxy-1  | panic({0x1029280, 0xc0007e0930})                                                                                                                                                                                       \r\nauthentik-proxy-1  |    /usr/local/go/src/runtime/panic.go:890 +0x263                                                                                                                                                                       \r\nauthentik-proxy-1  | goauthentik.io/internal/outpost/proxyv2/application.(*Application).Logout(0xc000208700, {0xc0006ff6c0, 0x40})                                                                                                          \r\nauthentik-proxy-1  |    /go/src/goauthentik.io/internal/outpost/proxyv2/application/session.go:97 +0x169d                                                                                                                                   \r\nauthentik-proxy-1  | goauthentik.io/internal/outpost/proxyv2/application.(*Application).handleSignOut(0xc000208700, {0x12cea40, 0xc00039b460}, 0xc00043b480?)                                                                               \r\nauthentik-proxy-1  |    /go/src/goauthentik.io/internal/outpost/proxyv2/application/application.go:274 +0x297                                                                                                                               \r\nauthentik-proxy-1  | net/http.HandlerFunc.ServeHTTP(0x0?, {0x12cea40?, 0xc00039b460?}, 0x12?)                                                                                                                                               \r\nauthentik-proxy-1  |    /usr/local/go/src/net/http/server.go:2122 +0x2f                                                                                                                                                                     \r\nauthentik-proxy-1  | goauthentik.io/internal/outpost/proxyv2/application.NewApplication.func3.1({0x12cea40, 0xc00039b460}, 0xc0007b6f00)                                                                                                    \r\nauthentik-proxy-1  |    /go/src/goauthentik.io/internal/outpost/proxyv2/application/application.go:187 +0x1f9                                                                                                                               \r\nauthentik-proxy-1  | net/http.HandlerFunc.ServeHTTP(0xc0006ff6c0?, {0x12cea40?, 0xc00039b460?}, 0x0?)                                                                                                                                       \r\nauthentik-proxy-1  |    /usr/local/go/src/net/http/server.go:2122 +0x2f                                                                                                                                                                     \r\nauthentik-proxy-1  | goauthentik.io/internal/outpost/proxyv2/application.NewApplication.func2.1({0x12cea40, 0xc00039b460}, 0xc0007b6f00)                                                                                                    \r\nauthentik-proxy-1  |    /go/src/goauthentik.io/internal/outpost/proxyv2/application/application.go:165 +0x222                                                                                                                               \r\nauthentik-proxy-1  | net/http.HandlerFunc.ServeHTTP(0xc0008c6d20?, {0x12cea40?, 0xc00039b460?}, 0x0?)                                                                                                                                       \r\nauthentik-proxy-1  |    /usr/local/go/src/net/http/server.go:2122 +0x2f                                                                                                                                                                     \r\nauthentik-proxy-1  | goauthentik.io/internal/utils/web.loggingHandler.ServeHTTP({{0x12cb9e0?, 0xc00039b420?}, 0xc00016f2d0?, 0xc0001256d0?}, {0x12cee30?, 0xc000482fc0}, 0xc0007b6f00)                                                      \r\nauthentik-proxy-1  |    /go/src/goauthentik.io/internal/utils/web/middleware.go:98 +0x12c                                                                                                                                                   \r\nauthentik-proxy-1  | github.com/gorilla/mux.(*Router).ServeHTTP(0xc000000300, {0x12cee30, 0xc000482fc0}, 0xc0007b6d00)                                                                                                                      \r\nauthentik-proxy-1  |    /go/pkg/mod/github.com/gorilla/mux@v1.8.0/mux.go:210 +0x1cf                                                                                                                                                         \r\nauthentik-proxy-1  | goauthentik.io/internal/outpost/proxyv2/application.(*Application).ServeHTTP(...)                                                                                                                                      \r\nauthentik-proxy-1  |    /go/src/goauthentik.io/internal/outpost/proxyv2/application/application.go:250                                                                                                                                      \r\nauthentik-proxy-1  | goauthentik.io/internal/outpost/proxyv2.(*ProxyServer).Handle(0xc00021c370, {0x12cee30, 0xc000482fc0}, 0xc0007b6d00)                                                                                                   \r\nauthentik-proxy-1  |    /go/src/goauthentik.io/internal/outpost/proxyv2/handlers.go:129 +0xa25                                                                                                                                              \r\nauthentik-proxy-1  | net/http.HandlerFunc.ServeHTTP(0x1136b00?, {0x12cee30?, 0xc000482fc0?}, 0x7f59d0?)                                                                                                                                     \r\nauthentik-proxy-1  |    /usr/local/go/src/net/http/server.go:2122 +0x2f                                                                                                                                                                     \r\nauthentik-proxy-1  | goauthentik.io/internal/outpost/proxyv2.NewProxyServer.func1.1({0x12cee30, 0xc000482fc0}, 0xc0003b9260?)                                                                                                               \r\nauthentik-proxy-1  |    /go/src/goauthentik.io/internal/outpost/proxyv2/proxyv2.go:46 +0x3c                           \r\nauthentik-proxy-1  | net/http.HandlerFunc.ServeHTTP(0xc0007b6c00?, {0x12cee30?, 0xc000482fc0?}, 0xc0008c79e8?)                                                                                                                              \r\nauthentik-proxy-1  |    /usr/local/go/src/net/http/server.go:2122 +0x2f                                               \r\nauthentik-proxy-1  | github.com/gorilla/mux.(*Router).ServeHTTP(0xc000000000, {0x12cee30, 0xc000482fc0}, 0xc0007b6b00)                                                                                                                      \r\nauthentik-proxy-1  |    /go/pkg/mod/github.com/gorilla/mux@v1.8.0/mux.go:210 +0x1cf                                   \r\nauthentik-proxy-1  | net/http.serverHandler.ServeHTTP({0xc0008cae40?}, {0x12cee30, 0xc000482fc0}, 0xc0007b6b00)                                                                                                                             \r\nauthentik-proxy-1  |    /usr/local/go/src/net/http/server.go:2936 +0x316                                              \r\nauthentik-proxy-1  | net/http.(*conn).serve(0xc00012efc0, {0x12cf600, 0xc0001998c0})                                  \r\nauthentik-proxy-1  |    /usr/local/go/src/net/http/server.go:1995 +0x612                                              \r\nauthentik-proxy-1  | created by net/http.(*Server).Serve                                                              \r\nauthentik-proxy-1  |    /usr/local/go/src/net/http/server.go:3089 +0x5ed\r\n```                                       \r\n**Version and Deployment (please complete the following information):**\r\n\r\n-   authentik version: 2023.4.1\r\n-   Deployment: docker-compose\r\n\r\n**Additional context**\r\nThe login works fine.\r\n\n", "before_files": [{"content": "# Generated by Django 4.1.7 on 2023-05-06 16:18\n\nfrom django.db import migrations, models\n\nimport authentik.providers.oauth2.models\n\n\nclass Migration(migrations.Migration):\n    dependencies = [\n        (\n            \"authentik_providers_oauth2\",\n            \"0015_accesstoken_auth_time_authorizationcode_auth_time_and_more\",\n        ),\n    ]\n\n    operations = [\n        migrations.AlterField(\n            model_name=\"refreshtoken\",\n            name=\"token\",\n            field=models.TextField(\n                default=authentik.providers.oauth2.models.generate_client_secret\n            ),\n        ),\n    ]\n", "path": "authentik/providers/oauth2/migrations/0016_alter_refreshtoken_token.py"}], "after_files": [{"content": "# Generated by Django 4.1.7 on 2023-05-06 16:18\n\nfrom django.db import migrations, models\n\nimport authentik.providers.oauth2.models\n\n\nclass Migration(migrations.Migration):\n    dependencies = [\n        (\n            \"authentik_providers_oauth2\",\n            \"0015_accesstoken_auth_time_authorizationcode_auth_time_and_more\",\n        ),\n    ]\n\n    operations = [\n        migrations.AlterField(\n            model_name=\"refreshtoken\",\n            name=\"token\",\n            field=models.TextField(\n                default=authentik.providers.oauth2.models.generate_client_secret\n            ),\n        ),\n        migrations.AlterField(\n            model_name=\"oauth2provider\",\n            name=\"sub_mode\",\n            field=models.TextField(\n                choices=[\n                    (\"hashed_user_id\", \"Based on the Hashed User ID\"),\n                    (\"user_id\", \"Based on user ID\"),\n                    (\"user_uuid\", \"Based on user UUID\"),\n                    (\"user_username\", \"Based on the username\"),\n                    (\n                        \"user_email\",\n                        \"Based on the User's Email. This is recommended over the UPN method.\",\n                    ),\n                    (\n                        \"user_upn\",\n                        \"Based on the User's UPN, only works if user has a 'upn' attribute set. Use this method only if you have different UPN and Mail domains.\",\n                    ),\n                ],\n                default=\"hashed_user_id\",\n                help_text=\"Configure what data should be used as unique User Identifier. For most cases, the default should be fine.\",\n            ),\n        ),\n    ]\n", "path": "authentik/providers/oauth2/migrations/0016_alter_refreshtoken_token.py"}]}