Unable to login to oauth after some time.

[DanTulovsky]

The bug

I have oauth working properly, it goes via cloudflare (which uses google accounts). No issues. Every once in a while, on a new computer where I need to login, it doesn't work.

I get the login screen, I click the button to try to login, and it eventually times out. The server logs show:

[Nest] 6  - 05/24/2024, 9:41:40 PM   ERROR [ImmichServer] [AuthService] Error in OAuth discovery: RPError: outgoing request timed out after 30000ms
[Nest] 6  - 05/24/2024, 9:41:40 PM   ERROR [ImmichServer] [AuthService] RPError: outgoing request timed out after 30000ms
    at /usr/src/app/node_modules/openid-client/lib/helpers/request.js:140:13
    at async Issuer.discover (/usr/src/app/node_modules/openid-client/lib/issuer.js:143:22)
    at async AuthService.getOAuthClient (/usr/src/app/dist/services/auth.service.js:245:28)
    at async AuthService.authorize (/usr/src/app/dist/services/auth.service.js:144:24)
[Nest] 6  - 05/24/2024, 9:41:45 PM     LOG [ImmichServer] [EventRepository] Websocket Connect:    iMU3QKmyUzdT3sKVAACR
[Nest] 6  - 05/24/2024, 9:41:58 PM     LOG [ImmichServer] [EventRepository] Websocket Disconnect: iMU3QKmyUzdT3sKVAACR

If I restart immich (I use docker compose) then I can immediately login again. I use a cloudflare tunnel to access the server (on a raspberry pi) remotely. I suspect something is running out of some resource, but I am not sure where to look. Next time this happens, what would be useful debug information to provide you with?

Thank you
Dan

The OS that Immich Server is running on

Debian 12 (piOS)

Version of Immich Server

v1.105.1

Version of Immich Mobile App

v1.105.1

Platform with the issue

• Server
• Web
• Mobile

Your docker-compose.yml content

#
# WARNING: Make sure to use the docker-compose.yml of the current release:
#
# https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
#
# The compose file on main may not be compatible with the latest release.
#

name: immich


services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    command: ['start.sh', 'immich']
    volumes:
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
      - /etc/localtime:/etc/localtime:ro
      - ${EXTERNAL_PATH}:/usr/src/app/external
    env_file:
      - .env
    ports:
      - 2283:3001
      - 8081:8081
    depends_on:
      - redis
      - database
    restart: always

  immich-microservices:
    container_name: immich_microservices
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    # extends: # uncomment this section for hardware acceleration - see https://immich.app/docs/features/hardware-transcoding
    #   file: hwaccel.transcoding.yml
    #   service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
    command: ['start.sh', 'microservices']
    volumes:
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
      - /etc/localtime:/etc/localtime:ro
      - ${EXTERNAL_PATH}:/usr/src/app/external
    env_file:
      - .env
    ports:
      - 8082:8081
    depends_on:
      - redis
      - database
    restart: always
    deploy:
      resources:
        limits:
          # Number of CPU threads
          cpus: '1.00'
          # Gigabytes of memory
          # memory: '1G'

  immich-machine-learning:
    container_name: immich_machine_learning
    # For hardware acceleration, add one of -[armnn, cuda, openvino] to the image tag.
    # Example tag: ${IMMICH_VERSION:-release}-cuda
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
    # extends: # uncomment this section for hardware acceleration - see https://immich.app/docs/features/ml-hardware-acceleration
    #   file: hwaccel.ml.yml
    #   service: cpu # set to one of [armnn, cuda, openvino, openvino-wsl] for accelerated inference - use the `-wsl` version for WSL2 where applicable
    volumes:
      - model-cache:/cache
    env_file:
      - .env
    restart: always
    deploy:
      resources:
        limits:
          # Number of CPU threads
          cpus: '1.00'
          # Gigabytes of memory
          # memory: '1G'

  redis:
    container_name: immich_redis
    image: registry.hub.docker.com/library/redis:6.2-alpine@sha256:51d6c56749a4243096327e3fb964a48ed92254357108449cb6e23999c37773c5
    restart: always

  database:
    container_name: immich_postgres
    image: registry.hub.docker.com/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
    volumes:
      - pgdata:/var/lib/postgresql/data
    restart: always
    ports:
      - 5432:5432

volumes:
  pgdata:
  model-cache:

Your .env content

# You can find documentation for all the supported env variables at https://immich.app/docs/install/environment-variables

# The location where your uploaded files are stored
UPLOAD_LOCATION=./library

# The Immich version to use. You can pin this to a specific version like "v1.71.0"
IMMICH_VERSION=v1.105.1

# Connection secret for postgres. You should change it to a random password
DB_PASSWORD=postgres

EXTERNAL_PATH=/home/dant/dropbox/Photos/

IMMICH_METRICS=true

# The values below this line do not need to be changed
###################################################################################
DB_HOSTNAME=immich_postgres
DB_USERNAME=postgres
DB_DATABASE_NAME=immich

REDIS_HOSTNAME=immich_redis

Reproduction steps

I cannot trigger it reliably.

Relevant log output

[Nest] 6  - 05/24/2024, 9:41:40 PM   ERROR [ImmichServer] [AuthService] Error in OAuth discovery: RPError: outgoing request timed out after 30000ms
[Nest] 6  - 05/24/2024, 9:41:40 PM   ERROR [ImmichServer] [AuthService] RPError: outgoing request timed out after 30000ms
    at /usr/src/app/node_modules/openid-client/lib/helpers/request.js:140:13
    at async Issuer.discover (/usr/src/app/node_modules/openid-client/lib/issuer.js:143:22)
    at async AuthService.getOAuthClient (/usr/src/app/dist/services/auth.service.js:245:28)
    at async AuthService.authorize (/usr/src/app/dist/services/auth.service.js:144:24)
[Nest] 6  - 05/24/2024, 9:41:45 PM     LOG [ImmichServer] [EventRepository] Websocket Connect:    iMU3QKmyUzdT3sKVAACR
[Nest] 6  - 05/24/2024, 9:41:58 PM     LOG [ImmichServer] [EventRepository] Websocket Disconnect: iMU3QKmyUzdT3sKVAACR

### Additional information

_No response_

[bo0tzz]

This looks to me like some sort of networking issue, not an Immich bug.

[DanTulovsky]

It may very well be, but the only thing I need to do to fix this issue is to restart immich and it instantly works.

[bossanova808]

(Immich v1.105.1)

Have been trying to setup Authelia with immich for a while now and am seeing this same error (albeit consistently).

I have Authelia/LLDAP otherwise working well (e.g. with calibre-web) - v4.38.8 (so at this stage just using local LDAP users, not cloud logins (yet?) (...although that is using reversy proxy auth not OIDC.)

I can manually hit other API functions successfully and get expected JSON back if I am logged into immich the normal way, e.g.
https://my.domain/api/library -> gives me a list of libraries

In the immich_server logs I have:

[Nest] 7  - 06/10/2024, 10:03:32 AM     LOG [ImmichServer] [RoutesResolver] OAuthController {/api/oauth}:
[Nest] 7  - 06/10/2024, 10:03:32 AM     LOG [ImmichServer] [RouterExplorer] Mapped {/api/oauth/mobile-redirect, GET} route
[Nest] 7  - 06/10/2024, 10:03:32 AM     LOG [ImmichServer] [RouterExplorer] Mapped {/api/oauth/authorize, POST} route
[Nest] 7  - 06/10/2024, 10:03:32 AM     LOG [ImmichServer] [RouterExplorer] Mapped {/api/oauth/callback, POST} route
[Nest] 7  - 06/10/2024, 10:03:32 AM     LOG [ImmichServer] [RouterExplorer] Mapped {/api/oauth/link, POST} route
[Nest] 7  - 06/10/2024, 10:03:32 AM     LOG [ImmichServer] [RouterExplorer] Mapped {/api/oauth/unlink, POST} route

...so the endpoint should be there....

If I try to manually POST to:
https://my.domain/api/oauth/authorize

I get an appropriate error, so the endpoint is reachable:

{
	"message": [
		"redirectUri must be a string",
		"redirectUri should not be empty"
	],
	"error": "Bad Request",
	"statusCode": 400
}

However, actually trying the Authelia login it consistently just hangs for a while then I get:

500 Internal Server Error 
{
	"message": "Error in OAuth discovery: RPError: outgoing request timed out after 30000ms",
	"statusCode": 500
}

Using bash inside the immich_server container, I can resolve my domain:

root@328a3c2095e2:/usr/src/app# getent hosts my.domain
209.99.24.99    my.domain

So...in all I am a bit confounded and stuck - and this is the only such error/report I can find, hence this contribution.

[Nest] 7  - 06/10/2024, 10:17:38 AM   ERROR [ImmichServer] [AuthService] Error in OAuth discovery: RPError: outgoing request timed out after 30000ms
[Nest] 7  - 06/10/2024, 10:17:38 AM   ERROR [ImmichServer] [AuthService] RPError: outgoing request timed out after 30000ms
    at /usr/src/app/node_modules/openid-client/lib/helpers/request.js:140:13
    at async Issuer.discover (/usr/src/app/node_modules/openid-client/lib/issuer.js:143:22)
    at async AuthService.getOAuthClient (/usr/src/app/dist/services/auth.service.js:245:28)
    at async AuthService.authorize (/usr/src/app/dist/services/auth.service.js:144:24)
[Nest] 7  - 06/10/2024, 10:22:32 AM     LOG [ImmichServer] [EventRepository] Websocket Connect:    FkKMgHKUTc-lDHblAAAF

...and the docker-compose.yml is the stock immich setup.

[bo0tzz]

Immich can't reach your oauth server. This will be an issue with configuration, dns, or networking. You say that inside the container you can resolve your domain, but can you actually reach the oauth server (eg with curl)?

[bossanova808]

I'm sure you're right but I'm struggling to see why/find the issue.

From outside the container? Can definitely reach it with e.g. curl from the host. Inside the container there is no curl, ping, nc, telnet etc...so not actually sure how to confirm that!

[ibrcic]

Hey @bossanova808 , were you ever able to resolve this? I am experiencing exactly the same issue as you for days now, with no luck in resolving it.

[DanTulovsky]

Does restarting the immich server fix it for you (it does for me every time).

[bossanova808]

Well, it started spontaneously working for me for a while, but after my recent update 1 1.1.18 it seems all broken again, albeit in a different way. I will return to looking at it in a couple months as I am busy with other things, but so far I find immich <> authelia to be a right mess, honestly (I do have several other apps working fine with authelia...)

[ibrcic]

No, it doesn't work even after restart.

…

On Mon, Jan 6, 2025, 19:51 MrWetsnow ***@***.***> wrote: Does restarting the immich server fix it for you (it does for me every time). — Reply to this email directly, view it on GitHub <#9748 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABL3FTHEJWJNP3BEE266OSD2JLGC3AVCNFSM6AAAAABUWBE4USVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTCNZVGI3DINQ> . You are receiving this because you commented.Message ID: ***@***.***>

[andrico21]

Same issue, Immich 1.133 - oauth works right after containers start, but in a few minutes doesn't work...

[Nest] 48  - 05/22/2025, 11:32:52 PM   ERROR [Api:OAuthRepository~ogy5axqg] Error in OAuth discovery: TypeError: fetch failed
[Nest] 48  - 05/22/2025, 11:32:52 PM   ERROR [Api:OAuthRepository~ogy5axqg] TypeError: fetch failed
    at node:internal/deps/undici/undici:13502:13
    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
    at async performDiscovery (file:///usr/src/app/node_modules/openid-client/build/index.js:266:16)
    at async discovery (file:///usr/src/app/node_modules/openid-client/build/index.js:243:16)
    at async OAuthRepository.getClient (/usr/src/app/dist/repositories/oauth.repository.js:85:20)
    at async OAuthRepository.authorize (/usr/src/app/dist/repositories/oauth.repository.js:25:24)
    at async AuthService.authorize (/usr/src/app/dist/services/auth.service.js:165:16)
    at async OAuthController.startOAuth (/usr/src/app/dist/controllers/oauth.controller.js:36:46)
[Nest] 48  - 05/22/2025, 11:32:52 PM   DEBUG [Api:LoggingInterceptor~ogy5axqg] POST /api/oauth/authorize 201 343.64ms 10.89.1.2
[Nest] 48  - 05/22/2025, 11:32:52 PM VERBOSE [Api:LoggingInterceptor~ogy5axqg] {"redirectUri":"https://myvalidaddress.freemyip.com/auth/login"}
[Nest] 48  - 05/22/2025, 11:32:52 PM   DEBUG [Api:GlobalExceptionFilter~ogy5axqg] HttpException(500): {"message":"Error in OAuth discovery: TypeError: fetch failed","statusCode":500}

[frankvoelker]

Any news on this???

### Edit:

For it seems to be some kind of TLS cert issue. I have local Authentik and local Immich running. I also have my own CA and TLS certificates. When my Authentik is for example:

https://authentik.homelab.lan/ with IPs

192.168.120.140:9443 (HTTPS)
192.168.120.140:9000 (HTTP)

then I try to set these in Immich as Oauth ISSUER_URL and it is NOT WORKING:

https://192.168.120.140:9443/application/o/immich/
https://authentik.homelab.lan/application/o/immich/

if I try the HTTP version the whole oauth process IS WORKING with this ISSUER_URL:

http://192.168.120.140:9000/application/o/immich/

but I have added my CA certificate into the immich server container and added to /etc/ssl/certs/ca-certificates.

maybe we need some option in oauth settings to add a textfield for a custom CA certificate that has to be trusted??

### Edit2:

working solution for me now is to add an env variable for Node.js to trust my own CA certificate like this:

    volumes:
      - ./my-root.crt:/etc/ssl/certs/my-root.crt:ro
    environment:
      - NODE_EXTRA_CA_CERTS=/etc/ssl/certs/my-root.crt 

Don't know if I also need to add my cert to /etc/ssl/certs/ca-certificates.crt but I did it just to be safe :-)