[Feature] Handle error and error_description more gracefully with denied via an Authorization Policy

[dubwoc]

I have searched the existing feature requests, both open and closed, to make sure this is not a duplicate request.

• Yes

The feature

This feature request is about changing how Immich's web client handles an access_denied from an IdP. Ideally Immich would match the OAuth 2.0 Auth RFC6749 compliant error response "access_denied" and provide a concise string of its own, something like "Unauthorized" as opposed to the current text: "Failed to finish oauth"

Longer version:

When configuring Authelia in such a way that it can deny a logged in user access to Immich, e.g. via a Authorization Policy, for users who are logged in but not allowed to access immich it returns them to immich with a URL like the following:

https://immich.example.org/auth/login?error=access_denied&error_description=The+resource+owner+or+authorization+server+denied+the+request.+The+user+was+denied+access+to+this+client.&iss=https%3A%2F%2Fauth.example.org&state=_Z_KLcslFReDacted00mFresfDxy1iPoSQfKeiZeOY

The parameters from the URL:
error: "access_denied"
error_description: "The resource owner or authorization server denied the request. The user was denied access to this client."

Immich's Web UI returns an ambiguous: "Failed to finish oauth":

My suggestion would be to interpret the OAuth 2.0 Auth RFC6749 compliant error value of access_denied that is returned with a string like "Unauthorized," a string i've seen other web applications use.

At a bare minimum surfacing back error and or the error_description directly to the user would be better than the current state as the above image shows.

---

Platform

• Server
• Web
• Mobile