Since wekan is already fetching user info from oauth, maybe its a good idea to use oauth groups to identify admins:

A oauth response looks like

"UserInfo": {
        "email": "dev1@kind.local",
        "email_verified": true,
        "groups": [
            "kind:developer"
        ],
        "name": "Dev 1",
        "preferred_username": "dev1",
        "rat": xxx,
        "sub": "xxx",
        "updated_at": xxx
    },

So having a env like:
OAUTH2_ADMIN_GROUPS="admins wekan:admins cluster-ops" .. comparing that list to the other one for admins
OAUTH2_USER_GROUPS="wekan-users app1:developer" ... for allowed users to access wekan.