[BUG] Failed to finish oauth

[Alexsaphir]

The bug

I set up authelia with immich and use OAuth to perform login. Everything worked fine, OAuth was working until recently when I tried to log in. I was prompted with the following message: Failed to finish oauth.

The OS that Immich Server is running on

Container K3s

Version of Immich Server

v1.92.1

Version of Immich Mobile App

v1.92.1

Platform with the issue

• Server
• Web
• Mobile

Your docker-compose.yml content

Running Immich on kubernetes.

Your .env content

DB_URL : secretKeyRef(database-immich.POSTGRES_URL) 
DISABLE_REVERSE_GEOCODING : true
IMMICH_MACHINE_LEARNING_URL : http://immich-machine-learning.immich.svc.cluster.local:3003
IMMICH_SERVER_URL : http://immich-server.immich.svc.cluster.local:3001
IMMICH_WEB_URL : http://immich-web.immich.svc.cluster.local:3000
LOG_LEVEL : verbose
NODE_ENV : production
REDIS_HOSTNAME : immich-redis.immich.svc.cluster.local
REDIS_PORT : 6379
TRANSFORMERS_CACHE : /usr/src/app/.transformers_cache
JWT_SECRET : secretKeyRef(immich-secret.JWT_SECRET)

Reproduction steps

I previously setup oauth and used it fine. Recently trying to login the oauth was not working anymore.

Additional information

I've made sure that the client id is the same between both applications.
The secret is also the same.

The server returns the following logs:

[Nest] 8  - 01/15/2024, 3:18:10 PM   ERROR [OPError: invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).)
    at processResponse (/usr/src/app/node_modules/openid-client/lib/helpers/process_response.js:38:13)
    at Client.grant (/usr/src/app/node_modules/openid-client/lib/client.js:1354:22)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async Client.callback (/usr/src/app/node_modules/openid-client/lib/client.js:493:24)
    at async AuthService.getOAuthProfile (/usr/src/app/dist/domain/auth/auth.service.js:225:24)
    at async AuthService.callback (/usr/src/app/dist/domain/auth/auth.service.js:167:25)
    at async OAuthController.finishOAuth (/usr/src/app/dist/immich/controllers/oauth.controller.js:39:38)] OPError: invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).)

Authelia is setup in the following manner:

identity_providers:
  oidc:
    cors:
      endpoints: [ 'authorization', 'token', 'revocation', 'introspection' ]
      allowed_origins_from_client_redirect_uris: true
    clients:
      - id: immich
        description: Immich
        secret: "${IMMICH_OAUTH_CLIENT_SECRET}"
        public: false
        authorization_policy: two_factor
        pre_configured_consent_duration: 1y
        scopes: [ 'openid', 'profile', 'email' ]
        redirect_uris:
          - https://photos.${SECRET_DOMAIN_NAME}/auth/login
          - https://photos.${SECRET_DOMAIN_NAME}/user-settings
          - app.immich:/
        userinfo_signing_algorithm: none

[jrasm91]

Can you confirm if you have configured oauth in immich via a configuration file or the UI and if you have verified that these details match your current authelia configuration?

[Alexsaphir]

I recreated the oauth secret from scratch and it's working now. I may had have an issue with how I previously created them.

Sorry for the user error.

[jrasm91]

No problem, glad you got it figured out!

[gravelfreeman]

Hey I'm using Authelia and I'm getting the same error as you. Have you updated to the latest version of Immich? Because there was a breaking change in version 1.95.1 that requires RS256 which isn't setup in your configuration. There's issue #7877 here that seems to be related to RS256 not working properly with Authelia.

I'm asking here since you might have gotten this issue if you've updated?

[jrasm91]

Can you open a new discussion in the q&a section and tag me? I can help you troubleshoot this over there.