Logging with oauth : wrong redirect uri

[caplam]

The bug

I setup immich a while ago. Recently I am setting up Authentik as sso provider.
Authentik correctly log me with oauth in portainer.
I'm unable to configure it correctly with immich.
Mobile app on iOS logs correctly with oauth but when using web app I have a "redirect uri error"
The request fails due to a missing, invalid, or mismatching redirection URI (redirect_uri).

Redirect URI setup in Authentik are:
strict: app.immich:///oauth-callback regex: http://192.168.2.50:2283/auth/login regex: http://192.168.2.50:2283/user-settings regex: http://192.168.2.50:2283

I tried both with regex or strict. I tried the 3 uri with ip one at a time. When I add "*. " as uri it works but as I read it's a risk.

The OS that Immich Server is running on

docker compose on Unraid

Version of Immich Server

v1.125.1

Version of Immich Mobile App

1.124.0 build 187

Platform with the issue

• Server
• Web
• Mobile

Your docker-compose.yml content

name: immich

services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    volumes:
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
      - /etc/localtime:/etc/localtime:ro
      - ${EXTERNAL_PATH}:/usr/src/app/external
    env_file:
      - .env
    ports:
      - 2283:2283
    depends_on:
      - redis
      - database
    restart: always
    
  immich-folder-album-creator:
    container_name: immich_folder_album_creator
    image: salvoxia/immich-folder-album-creator:latest
    restart: unless-stopped
    environment:
      API_URL: ${API_URL}
      API_KEY: ${API_KEY}
      ROOT_PATH: ${ROOT_PATH}
      CRON_EXPRESSION: "0 * * * *"
      TZ: Europe/Paris
      ALBUM_LEVELS: ${ALBUM_LEVELS}
      

  immich-machine-learning:
    container_name: immich_machine_learning
    # For hardware acceleration, add one of -[armnn, cuda, openvino] to the image tag.
    # Example tag: ${IMMICH_VERSION:-release}-cuda
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
    # extends: # uncomment this section for hardware acceleration - see https://immich.app/docs/features/ml-hardware-acceleration
    #   file: hwaccel.ml.yml
    #   service: cpu # set to one of [armnn, cuda, openvino, openvino-wsl] for accelerated inference - use the `-wsl` version for WSL2 where applicable
    device_cgroup_rules:
      - "c 189:* rmw"
    devices:
      - /dev/dri:/dev/dri
    volumes:
      - /dev/bus/usb:/dev/bus/usb
      - model-cache:/cache
    env_file:
      - .env
    restart: always

  redis:
    container_name: immich_redis
    image: registry.hub.docker.com/library/redis:6.2-alpine@sha256:84882e87b54734154586e5f8abd4dce69fe7311315e2fc6d67c29614c8de2672
    restart: always

  database:
    container_name: immich_postgres
    image: registry.hub.docker.com/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
      POSTGRES_INITDB_ARGS: '--data-checksums'
    volumes:
      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
    restart: always
    command: ["postgres", "-c" ,"shared_preload_libraries=vectors.so", "-c", 'search_path="$$user", public, vectors', "-c", "logging_collector=on", "-c", "max_wal_size=2GB", "-c", "shared_buffers=512MB", "-c", "wal_compression=on"]

volumes:
  model-cache:

Your .env content

# The location where your uploaded files are stored
UPLOAD_LOCATION=/mnt/user/photos-immich
# The location where your database files are stored
DB_DATA_LOCATION=/mnt/user/appdata/immich/db=

# The location of external lib
EXTERNAL_PATH=/mnt/user/icloud-drive-sync/photos


# The Immich version to use. You can pin this to a specific version like "v1.71.0"
IMMICH_VERSION=release

# Connection secret for postgres. You should change it to a random password
DB_PASSWORD=redacted


# The values below this line do not need to be changed
###################################################################################
DB_USERNAME=postgres
DB_DATABASE_NAME=immich

###################################################################################
# env var for docker crating albums from folders in external lib
###################################################################################
ROOT_PATH=/usr/src/app/external/
# A single or a comma separated list of import paths for external libraries in Immich

API_URL=http://immich_server:2283/api
# The root API URL of immich, e.g. https://immich.mydomain.com/api/

API_KEY=redacted
# The Immich API Key to use

ALBUM_LEVELS="2,2"
# Number of sub-folders or range of sub-folder levels below the root path used for album name creation.
# Positive numbers start from top of the folder structure, negative numbers from the bottom. Cannot be 0. 
# If a range should be set, the start level and end level must be separated by a comma. 

ALBUM_SEPARATOR=
# Separator string to use for compound album names created from nested folders. 
# Only effective if -a is set to a value > 1 (default: " ")

CHUNK_SIZE=
# Maximum number of assets to add to an album with a single API call (default: 2000)

FETCH_CHUNK_SIZE=
# Maximum number of assets to fetch with a single API call (default: 5000)

#LOG_LEVEL=
# Log level to use (default: INFO), allowed values: CRITICAL,ERROR,WARNING,INFO,DEBUG

Reproduction steps

...

Relevant log output

[Nest] 17  - 01/24/2025, 3:05:39 PM   DEBUG [Api:LoggingInterceptor~y6qlxn6g] GET /api/server/ping 200 0.37ms ::ffff:127.0.0.1
[Nest] 17  - 01/24/2025, 3:06:09 PM   DEBUG [Api:LoggingInterceptor~o0swzkqf] GET /api/server/ping 200 0.36ms ::ffff:127.0.0.1
[Nest] 17  - 01/24/2025, 3:06:39 PM   DEBUG [Api:LoggingInterceptor~p4fjz4om] GET /api/server/ping 200 0.33ms ::ffff:127.0.0.1
[Nest] 17  - 01/24/2025, 3:06:54 PM   DEBUG [Api:LoggingInterceptor~jwb95evi] GET /custom.css 200 5.83ms 192.168.2.90
[Nest] 17  - 01/24/2025, 3:06:54 PM   DEBUG [Api:LoggingInterceptor~zmhy882j] GET /api/server/features 200 6.31ms 192.168.2.90
[Nest] 17  - 01/24/2025, 3:06:54 PM   DEBUG [Api:LoggingInterceptor~9tlnki84] GET /api/server/config 200 8.32ms 192.168.2.90
[Nest] 17  - 01/24/2025, 3:07:02 PM   DEBUG [Api:LoggingInterceptor~9tfl9cfr] POST /api/oauth/authorize 201 454.37ms 192.168.2.90

Additional information

When i have the redirect uri error and click "go home" I'm redirected to Authentik interface for logging in; from there if click on immich app and chose log with oauth I'm directly logged in immich.

[foux]

I think there is a regression in v1.125 or v1.124. I've had OAuth setup for a while, and it worked flawlessly. But since upgrading to v1.125 (I've skipped v1.124), I've indeed the error The request fails due to a missing, invalid, or mismatching redirection URI (redirect_uri).

My redirect URI are :

strict: app.immich:///oauth-callback
strict: https://my.immich.tld/auth.login
strict: https://my.immich.tld/user-settings

And this doesn't work anymore on v1.125

[foux]

OK, so I've seen the issue. The doc has been updated to move from https://my.immich.tld/auth.login to https://my.immich.tld/auth/login. It works after the change

[caplam]

I have it working.
For portainer uri works with internal ip of server. For immich you have to use FQDN.