Run oauth2_proxy with nginx auth_request but not if the client already prestented HTTP credentials (basic auth)

default.conf

server {
    listen       80;
    server_name  localhost;

  location /oauth2/ {
    proxy_pass       http://oauth-proxy:4180;
    proxy_set_header Host                    $host;
    proxy_set_header X-Real-IP               $remote_addr;
    proxy_set_header X-Scheme                $scheme;
    proxy_set_header X-Auth-Request-Redirect $request_uri;
    # or, if you are handling multiple domains:
    # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
  }

  location = /oauth2/auth {
    proxy_pass       http://oauth-proxy:4180;
    proxy_set_header Host             $host;
    proxy_set_header X-Real-IP        $remote_addr;
    proxy_set_header X-Scheme         $scheme;
    # nginx auth_request includes headers but not body
    proxy_set_header Content-Length   "";
    proxy_pass_request_body           off;
  }

  location / {
    if ($http_authorization) {
        # pass through if http authorization is given, otherwise use oauth for auth
        rewrite ^(.*)$ /basicauthed$1 last;
    }

    auth_request /oauth2/auth;
    error_page 401 = /oauth2/sign_in;

    # pass information via X-User and X-Email headers to backend,
    # requires running with --set-xauthrequest flag
    auth_request_set $user   $upstream_http_x_auth_request_user;
    auth_request_set $email  $upstream_http_x_auth_request_email;
    proxy_set_header X-User  $user;
    proxy_set_header X-Email $email;

    # if you enabled --pass-access-token, this will pass the token to the backend
    auth_request_set $token  $upstream_http_x_auth_request_access_token;
    proxy_set_header X-Access-Token $token;

    # if you enabled --cookie-refresh, this is needed for it to work with auth_request
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    add_header Set-Cookie $auth_cookie;

    # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb
    # limit and so the OAuth2 Proxy splits these into multiple parts.
    # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,
    # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.
    auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;

    # Extract the Cookie attributes from the first Set-Cookie header and append them
    # to the second part ($upstream_cookie_* variables only contain the raw cookie content)
    if ($auth_cookie ~* "(; .*)") {
        set $auth_cookie_name_0 $auth_cookie;
        set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";
    }

    # Send both Set-Cookie headers now if there was a second part
    if ($auth_cookie_name_upstream_1) {
        add_header Set-Cookie $auth_cookie_name_0;
        add_header Set-Cookie $auth_cookie_name_1;
    }

    proxy_pass http://backend:8080/;
    # or "root /path/to/site;" or "fastcgi_pass ..." etc
  }

  location ~ /basicauthed(.*) {
    internal;
    proxy_pass http://backend:8080/$1;
    proxy_set_header Authorization $http_authorization;
    proxy_pass_header  Authorization;
    # Set to empty or external user can pass the authed email to the proxied server
    proxy_set_header X-User  "";
    proxy_set_header X-Email "";
  }
}

oauth_proxy.cfg

http_address = "127.0.0.1:4180"

## pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream
pass_basic_auth = true
pass_user_headers = true
pass_authorization_header = true

## pass the request Host Header to upstream
## when disabled the upstream Host is used as the Host Header
pass_host_header = true
pass_access_token = false

# cookie secret from output of python -c 'import os,base64; print base64.urlsafe_b64encode(os.urandom(16))'
cookie_secret = "CmItD3Q0XeU-3S0XOv-B3w=="
skip_provider_button = true

# Go to https://github.com/settings/applications and create an oauth app
# Enter http://lvh.me:4180/oauth2/callback as the callback URL
# go back here and fill in the client_id+secret
provider = "github"
client_id = "1234"
client_secret = "0a1234"

# upstreams = [
#  "http://127.0.0.1:8080/"
# ]

redirect_url = "http://lvh.me:4180/oauth2/callback"

cookie_secure = false

run.sh

docker run -dit --rm --name oauth-proxy \
    -v $(pwd)/oauth_proxy.cfg:/etc/oauth_proxy.cfg \
    quay.io/pusher/oauth2_proxy \
    --http-address="0.0.0.0:4180" \
    -config=/etc/oauth_proxy.cfg \
    -set-xauthrequest \
    -set-authorization-header \
    -pass-access-token \
    -email-domain=*

# run a demo backend that echos headers
docker run -dit --rm --name backend brndnmtthws/nginx-echo-headers

# then run nginx pointing to the oauth-proxy and backend containers
docker run -dit --rm --name oauth-nginx -p 8080:80 -v $(pwd)/default.conf:/etc/nginx/conf.d/default.conf --link oauth-proxy --link backend nginx

# we use http://lvh.me that resolves to 127.0.0.1, just like localhost

# curl with basic auth should be passed to the backend and output the headers from the echo-headers server
curl -v -u user:pass http://lvh.me/
# now try to access the site, should redirect you to GitHub auth for your created oauth app
# and then present the echo-headers server showing requests headers including:
# X-User: <your github account>
# X-Email: <your github email>
# Host: backend:8080
open http://lvh.me:8080/

# The real backend app could authenticate user either by HTTP authorization or trust the X-Email header added by the oauth proxy
# and the client can't pass the X-Email directly
# curl -v -u foo:bar -H 'X-Email: admin@domain' http://lvh.me:8080/