public/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2025-11-02 21:27:39 +09:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity
Files
7dc12dea1e3c7bec5429ab0824efd3accafec8cd
immich/docs/docs/features/oauth.md
Jason Rasmussen 7dc12dea1e feat(web,server): link/unlink oauth account (#1154) 
* feat(web,server): link/unlink oauth account

* chore: linting

* fix: broken oauth callback

* fix: user core bugs

* fix: tests

* fix: use user response

* chore: update docs

* feat: prevent the same oauth account from being linked twice

* chore: mock logger
2022-12-26 09:35:52 -06:00

3.7 KiB
Raw Blame History

OAuth Authentication

This page contains details about using OAuth in Immich.

Overview

Immich supports 3rd party authentication via OpenID Connect (OIDC), an identity layer built on top of OAuth2. OIDC is supported by most identity providers, including:

Prerequisites

Before enabling OAuth in Immich, a new client application needs to be configured in the 3rd-party authentication server. While the specifics of this setup vary from provider to provider, the general approach should be the same.

  1. Create a new (Client) Application

    1. The Provider type should be OpenID Connect or OAuth2
    2. The Client type should be Confidential
    3. The Application type should be Web
    4. The Grant type should be Authorization Code

  2. Configure Redirect URIs/Origins

The Sign-in redirect URIs should include:

  • app.immich:/ - for logging in with OAuth from the Mobile App
  • http://DOMAIN:PORT/auth/login - for logging in with OAuth from the Web Client
  • http://DOMAIN:PORT/user-settings - for manually linking OAuth in the Web Client

:::info Redirect URIs

Redirect URIs should contain all the domains you will be using to access Immich. Some examples include:

Mobile

  • app.immich:/ (You MUST include this for iOS and Android mobile apps to work properly)

Localhost

  • http://localhost:2283/auth/login
  • http://localhost:2283/user-settings

Local IP

  • http://192.168.0.200:2283/auth/login
  • http://192.168.0.200:2283/user-settings

Hostname

  • https://immich.example.com/auth/login)
  • https://immich.example.com/user-settings)

:::

Enable OAuth

Once you have a new OAuth client application configured, Immich can be configured using the Administration Settings page, available on the web (Administration -> Settings).

Setting Type Default Description
Enabled boolean false Enable/disable OAuth
Issuer URL URL (required) Required. Self-discovery URL for client (from previous step)
Client ID string (required) Required. Client ID (from previous step)
Client secret string (required) Required. Client Secret (previous step)
Scope string openid email profile Full list of scopes to send with the request (space delimited)
Button text string Login with OAuth Text for the OAuth button on the web
Auto register boolean true When true, will automatically register a user the first time they sign in

:::info The Issuer URL should look something like the following, and return a valid json document.

  • https://accounts.google.com/.well-known/openid-configuration
  • http://localhost:9000/application/o/immich/.well-known/openid-configuration

The .well-known/openid-configuration part of the url is optional and will be automatically added during discovery. :::

Here's an example of OAuth configured for Authentik:

OAuth Settings