[Guide] Cloudflare Tunnels with SSO/OAuth working for immich

[shanelord01]

I've just set this up using Cloudflare Tunnels and a SaaS App for immich. This assumes you've setup an Auth Provider in Cloudflare Zero Trust Settings/Authentication already. Example setup for Google here.

1. In Cloudflare Zero Trust / Networks

   • Setup a public hostname in Networks/Tunnels for (ie immich.yourdomain.com) in your tunnel with no access control

2. In Cloudflare Access, setup a SaaS application called immich

   • Follow the OAuth setup for immich here.

   • In Cloudflare setup the redirect URI's for Mobile, Local IP and Hostname ("public hostname" set in step 1 above)

     • Choose OpenID Connect (OIDC)
     • Set "Scopes" to openid email profile
     • You should have at least these setup for Redirect URIs/Origins:

       app.immich:/
       http://local_IP:2283/auth/login
       http://local_IP:2283/user-settings
       https://immich.yourdomain.com/auth/login
       https://immich.yourdomain.com/user-settings
       

       Note: Replace "local_IP" with local LAN IP address for immich server, and "immich.yourdomain.com" with your public domain.

   • Disable "Proof Key for Code Exchange (PKCE)"

   • Set your App Launcher URL to your https://immich.yourdomain.com/ set in step 1.

   • Add a custom icon link.

   • Under "Policies", add a policy:

     • Policy name: email
     • Action: Allow
     • Create Additional Rules: Include Login Methods: Your Auth provider

   • Under Authentication, set it to whichever Identity Providers you want to support.

3. In immich:

   • Go to Administration/Settings/OAuth Authentication
   • Input the values provided by Cloudflare access for Issuer (Issuer URL), Client ID and Client Secret.
   • Click Save.

Once tested working, you can do the following final steps in immich:
- Enable "Auto Launch" to streamline things.
- Under "Password Authentication", disable it (forcing users to use OAuth).

Working perfectly for me and works with the app too!

[loopiv]

Can confirm that this works great. Thanks so much!

[kerhbal]

thanks, it works for me. though I have to set the the override redirect url https://immich.kerbalrocket.com/api/oauth/mobile-redirect to make it work

[mmomjian]

@shanelord01 would you be willing to write this up for the Guides section of the docs?

[shanelord01]

Happy to. I’ll get to it when back from my weekend away.

[mmomjian]

Hey @shanelord01 hope you're doing well. Wanted to check in to see if you are still interested in making a PR to add this to the docs or if you'd rather I do it? Seems like this has helped a lot of users.

[shanelord01]

Hi @mmomjian I have written one and submitted - seems there's an error in the pull request I don't know how to fix: #8614

[mmomjian]

Oh I see that now. The errors aren’t a problem - it will probably get merged soon.

[bshor]

So far I've been using Cloudflare tunnel to enable me to set up a custom domain name for my self-hosted apps. This has worked pretty well with Immich. But the way it works is that I still have to enter a password and username. If I understand this tutorial, this would use Cloudflare to bypass the Immich login screen, which sounds great.

But I'm presented by options I don't understand.

On the very first page of "Add an application" (after selecting SaaS under Access), it asks me whether I want SAML or OIDC. I don't know what to choose so I pick SAML. Then I see this (and more).

I'm not sure how to proceed.

ps I'm not sure how to "Follow the OAuth setup for immich here"

[shanelord01]

You need to select OIDC.

I’ll try and put more info in the guide when I write it.

[lyassinel]

thank you for your guide, but unfortunately I'm the opposite of an expert in this field. I managed to configure my immich correctly but here I can't understand your guide exactly. Could you detail the steps to accomplish this? I have not been able to complete the step with the redirections, nor have I been able to complete the immich Oauth guide.

Thank you

[maxmlvc]

It works great. Thank you!!

[davidrudlstorfer]

Thanks for your guide! Until now I wasn't able to setup Cloudflare Zero Trust with Immich. Does your proposed solution also work with the mobile app? Thanks in advance!

[selimovd]

Yes it does, just set it up myself with this tutorial 😊

[bryan065]

Just wanted to say thanks! Confirmed it works on web and mobile

[renfie]

Unfortunately, it doesn't work for me. The following error message is displayed:

{"error":"invalid_request","error_description":"Invalid redirect_uri - does not match configured values"}
The following redirect URLs are stored:

https://immich.xxx.de
https://immich.xxx.de/api/oauth/mobile-redirect
https://immich.xxx.de/auth

[bryan065]

You've got your redirect URL's wrong.

• http://DOMAIN/auth/login

• http://DOMAIN/user-setting

• http://DOMAIN/api/oauth/mobile-redirect

Step 1:

CloudFlare guide to get google OAuth working with CloudFlare Access:
https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/google/

• follow above guide to get CloudFlare access working with Google OAuth

Step 2:

• Create your CloudFlare SaaS app as the original op instructions. Use the redirect URLs from immich (above).

Step 3:

• Then make sure you grab the client ID, secret, and issuer URL from the CloudFlare SaaS app that you had made.

• The CloudFlare issuer URL should be https://[TEAM_NAME].cloudflareaccess.com/cdn-cgi/access/SSO/oidc/xxxxxxx

• Enter that info into immich OAuth settings.

I can do a detailed write-up once I'm at a PC.

Edit: I've just set up several instances all with CloudFlare access and google OAuth. Migrating all the photos over from NextCloud memories was a breeze (immich-go).

[renfie]

Thank you very much @bryan065, I will give it a try. It's definitely nicely detailed.

[PatrickA3]

This works great! Thank you very much!

[GHerce]

This is the best writeup I've seen for getting OAuth to work. Thank-you @bryan065!

Upon selecting "Login with OAuth" button, select google account, enter password. I am returned to the login page with the message: "Error in OAuth discovery: AggregateError."

Have others come across this? I have double-checked my work against these instructions, and I can't see what I may have fat-fingered.

From my windows desktop, i start edge browser, enter my App Launcher URL as specified in cloudflare tunnel configuration. The cloudflare tunnel is linked to a my NAS running openmediavault.

The log with bitdefender enabled
immich_server | [Nest] 7 - 04/11/2024, 2:08:50 AM ERROR [AuthService] Error in OAuth discovery: AggregateError
immich_server | [Nest] 7 - 04/11/2024, 2:08:50 AM ERROR [AuthService]

The log with bitdefender disabled
immich_server | [Nest] 7 - 04/11/2024, 2:05:02 AM ERROR [AuthService] Error in OAuth discovery: Error: getaddrinfo EAI_AGAIN .cloudflareaccess.com
immich_server | [Nest] 7 - 04/11/2024, 2:05:02 AM ERROR [AuthService] Error: getaddrinfo EAI_AGAIN .cloudflareaccess.com
immich_server | at GetAddrInfoReqWrap.onlookupall [as oncomplete] (node:dns:118:26)

[shanelord01]

"EAI_AGAIN" is a DNS lookup timeout error - ie it can't find the domain it's looking for. Have you got the "ISSUER URL" address correct in immich OAuth settings?

Check you can ping cloudflareaccess.com first:
ping cloudflareaccess.com

You should get an IPv4 or IPv6 reply. If that doesn't work your router is doing something funky. If it does work:

Currently that log shows it's just going to ".cloudflareaccess.com" - which may mean the Issuer URL is wrong. Check the address shared in Cloudflare Zero Trust/Access/Applications/immich/Overview then under "Issuer" and make sure that is in the immich OAuth "ISSUER URL" field.

[GHerce]

Thank-you shanelord01! I omitted my full team name when I pasted to the forum, and thought I had included to make that distinguishment. I didn't do anything but wait 24 hours, and it mysteriously worked. I'll take it. Again, THANK-YOU so much!

[aad4321]

Great article. So i got this working and with multiple email addresses. I am using Google in cloudflare as the auth provider but I have 2 questions.

1. It looks like you can still login with local credentials and not use oauth? The main reason I wanted to so this was to provide MFA no matter how you login. Can local account login be disabled or hidden?

2. How does this work with sharing photos for non registered users. Will they be hit with the cloudflare auth page?

[shanelord01]

@aad4321

1. Disable "Login with email and password" under immich Administration/Settings/Password Authentication
2. Sharing works fine - no need to login! Just make sure your domain is set correctly in immich Administration/Settings/Server Settings/EXTERNAL DOMAIN

[jarrah31]

I'm hoping someone can help spot my silly mistake somewhere please because I can't find where the problem is... Basically I get the following error:
{"error":"invalid_request","error_description":"Invalid redirect_uri - does not match configured values"}

I can browse to the URL and see the Immich logon prompt where I select "Login with OAuth" (which at least indicates the public hostname tunnel is working ok). I click the link and I'm prompted to sign in with Google as my OAuth provider. It then redirects me to the above error message.

Here are my Cloudflare redirect URLs:

Within Immich I've double checked the Issuer URL is correct:

The Policy looks ok:

Plus Authentication is set up to use Google which looks ok too.

I honestly can't spot the problem so apologies if I've missed something obvious. :)

[jarrah31]

Hi @bryan065 thank you for your help. As seen in my screenshot above I only have app.immich:/ that doesn't end in /auth/login, /user-settings, and /api/oauth/mobile-redirect. I've tried removing that but it hasn't helped unfortunately.
I've also confirmed that the Issuer URL is valid and ends in my token.
It's very odd - if you all think my current config from the screenshots look ok then it must be an issue outside of the SaaS application that can't be easily solved from here. :)

[jarrah31]

Is there a way to see which Invalid redirect_uri is being used via Chrome's dev console?

[BourbonDoc]

I'm having the exact same problem. What's more frustrating is that it had been working wonderfully previously and suddenly stopped. No software updates. I restarted the entire process to see if anything had gone wrong behind the scenes. Same issue. Can't add any policies and get the same error so I can't save. The firefox dev console says "was blocked by OpaqueResponseBlocking. Reason: “after sniff: status code is not in allowed range”.

[yonesmit]

Is was working perfect but now cloudflare doesn't accept the URL:
app.immich:/
as redirection. It displays error:
Error configuring your application: Access api error invalid_request: redirect_uris[0] must be a valid URL
So it fails in both iOS and Android app.

[BourbonDoc]

That seems to be correct! Any workarounds found yet?

[tfred93]

I have followed the guide and was able to set this up correctly for the web links. I am having trouble setting up for the mobile. When I enter the server endpoint URL into the app, using the same link as i would on the web, it brings me to the (Email/Password) screen. I have disabled this to only allow the oauth login method. I also do not have the option to use the oauth login method in the app. Did I miss a step in setting this up?

my redirects for set up in cloudflare are the 5 listed in the original post and also the http://domain/api/oauth/mobile-redirect link. (domain being my specific domain)

[tusc]

Great article, managed to get this to work after figuring out I fat-fingured the redirect URLS. For those that are getting "Invalid redirect_uri" you might want to double check the redirect URL entries. That was causing the error when accessing the site.

One question, I'm trying to determine the best way to log IP addresses from clients accessing the site. Are the two option availble include:

1. Enable verbose logging within Immich?
2. Setup a reverse proxy in front of Immich?

[yonesmit]

Hi,
Thanks a lot for the guide. I followed it and it works ok except in iOS mobile app.
When I use iOS mobile app I select "Login with OAuth", I select my gmail account, enter password, etc and then app go back to login screen.
The same as @tfred93 reported, but for me it works correctly with Android mobile app (of course also works with browsers).
When I go to Cloudflare Access Logs I can see the my login attampt is correct (Access granted) same as when I login from browser so seems a iOS app problem or redirect problem.
Can somebody help?
Thanks in advance
Best Regards

[TajAFK]

I have the same problem. Did you find any solution yet ?

[TajAFK]

Earlier, immich was on synology and now i had installed it on Qnap. Surprisingly it worked on mobile too. Really no idea, what has changed.

[yonesmit]

The solution I found to make this work with iOS mobile was:

• Enabling MOBILE REDIRECT URI OVERRIDE in Immich settings and setting MOBILE REDIRECT URI to: https://immich.MYDOMAIN/api/oauth/mobile-redirect
• Redirecting this URL (https://immich.MYDOMAIN/api/oauth/mobile-redirect) in Cloudflare.
  With these changes the iOS app logins correctly for me.

Thanks again to all.

[TajAFK]

Thanks, i did as you said but still did not work. Issue only persist on ios and android works fine.

[TajAFK]

The Guide perfectly works. Thank you so much. I would like to add a few points

1. Some users complained about invalid URL, please make sure you add them correctly. Check this picture
2. Also in policies, please add require too to add your email or someone you want to give access otherwise anyone with google account can create a user in immich. Check the picture
   
   

[tusc]

Regards point 2, I believe you can avoid having to add emails in Cloudflare if you change the following settings in Immich:

Settings>OAuth Authentication>Auto Register (untick)
IMHO this should be disabled by default for security reasons.

You might also want to disable password authentication if you are now relying on OAuth:

Settings>Password Authentication>ENALBED (untick)

[TajAFK]

Thank you, I did not know it before. Now I have disabled it plus also left the settings unchanged in Cloudflare policy since it can keep track of failed logins when someone tries to access them.

[TheChrisK]

Just swapped from a local Authentik instance to CF. Works great and I can MFA though Azure AD in addition to email. Good write up! Easy to follow.