Authelia OAuth fails in Android app after successful exchange

[kennedybaird]

I have searched the existing issues, both open and closed, to make sure this is not a duplicate report.

• Yes

The bug

OAuth authentication completes successfully on mobile app but all subsequent API calls return 401. Web OAuth works perfectly. Following both Immich and Authelia's official documentation.

This doesn't seem to be related to the other OAuth issues as I end up with a different issue.

It seems like the android app is potentially not identifying correctly to Authelia, as it comes through as .

The OS that Immich Server is running on

Ubuntu 22

Version of Immich Server

1.136

Version of Immich Mobile App

1.136

Platform with the issue

• Server
• Web
• Mobile

Your docker-compose.yml content

Quadlet container:

[Container]
Image=ghcr.io/immich-app/immich-server:release
ContainerName=immich-server
Environment=TZ=[redacted]
Environment=DB_HOSTNAME=immich-db
Environment=DB_USERNAME=immich_user
Environment=DB_PASSWORD=[redacted]
Environment=DB_DATABASE_NAME=immich
Environment=REDIS_HOSTNAME=redis
Environment=PUID=1201
Environment=PGID=1110
Environment=IMMICH_AUTH_TYPE=oauth
Environment=IMMICH_SERVER_URL=https://photos.[redacted]
Environment=OAUTH_CLIENT_ID=immich
Environment=OAUTH_CLIENT_SECRET=[redacted]
Environment=OAUTH_ISSUER_URL=https://auth.[redacted]
Environment=OAUTH_REDIRECT_URI=https://photos.[redacted]/auth/login

Relevant Authelia configuration.yml:

access_control:
  default_policy: 'deny' 
  rules:
    - domain: photos.595.nz
      policy: bypass
      resources:
        - '^/api/server/ping$'
        - '^/.well-known/immich$'
        - '^/api/oauth.*'           
        - '^/auth/login$'
        - '^/auth/logout$'
        - '^/api/server/config$'
        - '^/api/server/features$'
        - '^/api/server/version$'
        - 
identity_providers:
  oidc:
    enable_client_debug_messages: true
    jwks:
      - key_id: "immich"
        algorithm: "RS256"
        use: "sig"
        key: |
          -----BEGIN PRIVATE KEY-----
          [redacted]
          -----END PRIVATE KEY-----
    clients:
      - client_id: 'immich'
        client_name: 'Immich'
        client_secret: '$pbkdf2-sha512$310000$WOG3BOAHX4.[redacted]'
        public: false
        authorization_policy: 'one_factor'
        require_pkce: false
        pkce_challenge_method: ''
        redirect_uris:
          - https://photos.[redacted]/auth/login
          - https://photos.[redacted]/user-settings
          - 'app.immich:///oauth-callback'
        scopes:
          - 'openid'
          - 'profile'
          - 'email'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_post'

Reproduction steps

1. Configure Authelia + Immich OAuth per official docs
2. Open mobile app, click OAuth login
3. Successfully authenticate in Authelia
4. OAuth callback completes (logs show user email retrieved)
5. All API calls fail with 401 redirects to Authelia

...

Relevant log output

Android Logs

2025-07-28 20:24:47.421514 | info     | AlbumService         | Found 0 device albums |
2025-07-28 20:24:47.362179 | warning  | SyncService          | Failed to fetch users | ApiException 401: <a href="https://auth.[redacted]/?rd=https%3A%2F%2Fphotos.[redacted]%2Fapi%2Fusers&amp;rm=GET">401 Unauthorized</a> |
2025-07-28 20:18:37.354237 | severe   | AuthenticationNotifier | Error getting user information from the server [CATCH ALL] | ParallelWaitError(2 errors): ApiException 401: <a href="https://auth.[redacted]/?rd=https%3A%2F%2Fphotos.[redacted]%2Fapi%2Fusers%2Fme&amp;rm=GET">401 Unauthorized</a> |
#0      UsersApi.getMyUser (package:openapi/api/users_api.dart:245)
<asynchronous suspension>
#1      FutureRecord2.wait.<anonymous closure> (dart:async/future_extensions.dart:88)
<asynchronous suspension>
#2      UserApiRepository.getMyUser (package:immich_mobile/infrastructure/repositories/user_api.repository.dart:15)
<asynchronous suspension>
#3      UserService.refreshMyUser (package:immich_mobile/domain/services/user.service.dart:38)
<asynchronous suspension>
#4      Future.timeout.<anonymous closure> (dart:async/future_impl.dart:1064)
<asynchronous suspension>
#5      AuthNotifier.saveAuthInfo (package:immich_mobile/providers/auth.provider.dart:134)
<asynchronous suspension>
#6      LoginForm.build.oAuthLogin (package:immich_mobile/widgets/forms/login/login_form.dart:299)
<asynchronous suspension>

2025-07-28 20:18:37.312765 | info     | LoginForm            | Finished OAuth login with response: kennedy@[redacted] |
2025-07-28 20:18:36.873058 | info     | AlbumService         | Found 0 device albums |
2025-07-28 20:18:36.809848 | warning  | SyncService          | Failed to fetch users | ApiException 401: <a href="https://auth.[redacted]/?rd=https%3A%2F%2Fphotos.[redacted]%2Fapi%2Fusers&amp;rm=GET">401 Unauthorized</a> |
2025-07-28 20:18:36.623590 | info     | OAuthService         | Received OAuth callback: app.immich:///oauth-callback?code=authelia_ac_kX9t95FRb8IQhmYRwByvJ35mpnXxY0Jp4nDMLzkkL_4.0gpgkG1NRCAfK5mtUaV2l_uTNSTZZrWe0Wqpne7kTgI&iss=https%3A%2F%2Fauth.[redacted]&scope=openid+email+profile&state=d6JA56S1bU4Yfp4U9gxJr52xbSgcjXkO |
2025-07-28 20:18:33.113900 | info     | OAuthService         | Received Authorization URL: https://auth.[redacted]/api/oidc/authorization?redirect_uri=app.immich%3A%2F%2F%2Foauth-callback&scope=openid+email+profile&state=d6JA56S1bU4Yfp4U9gxJr52xbSgcjXkO&code_challenge=JRpgZAzI7XlrCUeMp7I5QuenC06m7IL_8aS2mSbJe-w&code_challenge_method=S256&client_id=immich&response_type=code |
2025-07-28 20:18:32.746305 | info     | OAuthService         | Starting OAuth flow with redirect URI: app.immich:///oauth-callback |

Authelia Logs

time="2025-07-28T20:28:42+12:00" level=debug msg="Check authorization of subject username= groups= ip=[redacted] and object https://photos.[redacted]/.well-known/immich (method GET)."
time="2025-07-28T20:28:42+12:00" level=debug msg="Check authorization of subject username= groups= ip=[redacted] and object https://photos.[redacted]/api/server/ping (method GET)."
time="2025-07-28T20:28:42+12:00" level=debug msg="Check authorization of subject username= groups= ip=[redacted] and object https://photos.[redacted]/api/oauth/authorize (method POST)."
time="2025-07-28T20:28:43+12:00" level=debug msg="Authorization Request with id '64e4329a-6a03-46a4-a9bf-8953ca81606d' on client with id 'immich' is being processed" method=GET path=/api/oidc/authorization remote_ip=[redacted]
time="2025-07-28T20:28:51+12:00" level=debug msg="Mark 1FA authentication attempt made by user 'kennedy'" method=POST path=/api/firstfactor remote_ip=[redacted]
time="2025-07-28T20:28:51+12:00" level=debug msg="Successful 1FA authentication attempt made by user 'kennedy'" method=POST path=/api/firstfactor remote_ip=[redacted]
time="2025-07-28T20:28:52+12:00" level=debug msg="Authorization Request with id 'ad874a56-eebc-4c05-95e7-87826f59989e' on client with id 'immich' is being processed" method=GET path=/api/oidc/authorization remote_ip=[redacted]
time="2025-07-28T20:28:52+12:00" level=debug msg="Authorization Request with id 'ad874a56-eebc-4c05-95e7-87826f59989e' on client with id 'immich' using consent mode 'explicit' authentication level 'one_factor' is sufficient for client level 'one_factor'" method=GET path=/api/oidc/authorization remote_ip=[redacted]
time="2025-07-28T20:28:52+12:00" level=debug msg="Authorization Request with id 'ad874a56-eebc-4c05-95e7-87826f59989e' on client with id 'immich' using consent mode 'explicit' is being redirected to 'https://auth.[redacted]/consent/openid/decision?flow=openid_connect&flow_id=aa7cac02-c47c-4013-a6aa-95651932900c'" method=GET path=/api/oidc/authorization remote_ip=[redacted]
time="2025-07-28T20:28:55+12:00" level=debug msg="Authorization Request with id 'e37f14e5-e94d-4076-ab65-5f42a05b8498' on client with id 'immich' is being processed" method=GET path=/api/oidc/authorization remote_ip=[redacted]
time="2025-07-28T20:28:55+12:00" level=debug msg="Authorization Request with id 'e37f14e5-e94d-4076-ab65-5f42a05b8498' on client with id 'immich' was successfully processed, proceeding to build Authorization Response" method=GET path=/api/oidc/authorization remote_ip=[redacted]
time="2025-07-28T20:28:55+12:00" level=debug msg="Check authorization of subject username= groups= ip=[redacted] and object https://photos.[redacted]/api/oauth/callback (method POST)."
time="2025-07-28T20:28:55+12:00" level=debug msg="Check authorization of subject username= groups= ip=[redacted] and object https://photos.[redacted]/api/users (method GET)."
time="2025-07-28T20:28:55+12:00" level=info msg="Access to https://photos.[redacted]/api/users (method GET) is not authorized to user <anonymous>, responding with status code 401 with location redirect to https://auth.[redacted]/?rd=https%3A%2F%2Fphotos.[redacted]%2Fapi%2Fusers&rm=GET" method=GET path=/api/authz/forward-auth remote_ip=[redacted]
time="2025-07-28T20:28:55+12:00" level=debug msg="Check authorization of subject username= groups= ip=[redacted] and object https://photos.[redacted]/api/partners?direction=shared-by (method GET)."
time="2025-07-28T20:28:55+12:00" level=info msg="Access to https://photos.[redacted]/api/partners?direction=shared-by (method GET) is not authorized to user <anonymous>, responding with status code 401 with location redirect to https://auth.[redacted]/?rd=https%3A%2F%2Fphotos.[redacted]%2Fapi%2Fpartners%3Fdirection%3Dshared-by&rm=GET" method=GET path=/api/authz/forward-auth remote_ip=[redacted]
time="2025-07-28T20:28:55+12:00" level=debug msg="Access Request with id 'e37f14e5-e94d-4076-ab65-5f42a05b8498' on client with id 'immich' is being processed" method=POST path=/api/oidc/token remote_ip=[redacted]
time="2025-07-28T20:28:55+12:00" level=debug msg="Access Request with id 'e37f14e5-e94d-4076-ab65-5f42a05b8498' on client with id 'immich' has successfully been processed" method=POST path=/api/oidc/token remote_ip=[redacted]
time="2025-07-28T20:28:55+12:00" level=debug msg="User Info Request with id '869a28a1-4d50-4b82-aa11-9460fa05f8b9' is being processed" method=GET path=/api/oidc/userinfo remote_ip=[redacted]
time="2025-07-28T20:28:55+12:00" level=debug msg="User Info Request with id '869a28a1-4d50-4b82-aa11-9460fa05f8b9' on client with id 'immich' is being returned unsigned as per the registered client configuration" method=GET path=/api/oidc/userinfo remote_ip=[redacted]
time="2025-07-28T20:28:55+12:00" level=debug msg="User Info Request with id '869a28a1-4d50-4b82-aa11-9460fa05f8b9' on client with id 'immich' was successfully processed" method=GET path=/api/oidc/userinfo remote_ip=[redacted]
time="2025-07-28T20:28:56+12:00" level=debug msg="Check authorization of subject username= groups= ip=[redacted] and object https://photos.[redacted]/api/users/me/preferences (method GET)."
time="2025-07-28T20:28:56+12:00" level=info msg="Access to https://photos.[redacted]/api/users/me/preferences (method GET) is not authorized to user <anonymous>, responding with status code 401 with location redirect to https://auth.[redacted]/?rd=https%3A%2F%2Fphotos.[redacted]%2Fapi%2Fusers%2Fme%2Fpreferences&rm=GET" method=GET path=/api/authz/forward-auth remote_ip=[redacted]
time="2025-07-28T20:28:56+12:00" level=debug msg="Check authorization of subject username= groups= ip=[redacted] and object https://photos.[redacted]/api/users/me (method GET)."
time="2025-07-28T20:28:56+12:00" level=info msg="Access to https://photos.[redacted]/api/users/me (method GET) is not authorized to user <anonymous>, responding with status code 401 with location redirect to https://auth.[redacted]/?rd=https%3A%2F%2Fphotos.[redacted]%2Fapi%2Fusers%2Fme&rm=GET" method=GET path=/api/authz/forward-auth remote_ip=[redacted]

Additional information

Cloudflare Analytics show no blocks at the edge.

[danieldietzler]

You shouldn't be blocking API endpoints.

[kennedybaird]

Yeah, I'm sorry for wasting your time. I was just closing the issue and realised you'd closed it already.