Repository navigation
Oauth fails on mobile with 1.132.0 #17825
Description
I have searched the existing issues, both open and closed, to make sure this is not a duplicate report.
- Yes
The bug
Oauth does not complete on mobile but works as expected on web
The OS that Immich Server is running on
Debian 12
Version of Immich Server
v1.132.0
Version of Immich Mobile App
v1.132.0
Platform with the issue
- Server
- Web
- Mobile
Your docker-compose.yml content
name: immich
services:
immich-server:
container_name: immich_server
labels:
- "com.centurylinklabs.watchtower.monitor-only=true"
image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
# extends:
# file: hwaccel.transcoding.yml
# service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated
devices:
- /dev/dri:/dev/dri
volumes:
# Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the .env file
- ${UPLOAD_LOCATION}:/usr/src/app/upload
- /etc/localtime:/etc/localtime:ro
env_file:
- stack.env
ports:
- 2283:2283
depends_on:
- redis
- database
restart: always
healthcheck:
disable: false
environment:
PUID: 109
PGID: 117
redis:
container_name: immich_redis
labels:
- "com.centurylinklabs.watchtower.enable=false"
image: docker.io/redis:6.2-alpine@sha256:2d1463258f2764328496376f5d965f20c6a67f66ea2b06dc42af351f75248792
healthcheck:
test: redis-cli ping || exit 1
restart: always
environment:
PUID: 109
PGID: 117
database:
container_name: immich_postgres
labels:
- "com.centurylinklabs.watchtower.enable=false"
image: docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0
environment:
POSTGRES_PASSWORD: ${DB_PASSWORD}
POSTGRES_USER: ${DB_USERNAME}
POSTGRES_DB: ${DB_DATABASE_NAME}
POSTGRES_INITDB_ARGS: '--data-checksums'
PUID: 109
PGID: 117
volumes:
# Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
- ${DB_DATA_LOCATION}:/var/lib/postgresql/data
healthcheck:
test: pg_isready --dbname='${DB_DATABASE_NAME}' --username='${DB_USERNAME}' || exit 1; Chksum="$$(psql --dbname='${DB_DATABASE_NAME}' --username='${DB_USERNAME}' --tuples-only --no-align --command='SELECT COALESCE(SUM(checksum_failures), 0) FROM pg_stat_database')"; echo "checksum failure count is $$Chksum"; [ "$$Chksum" = '0' ] || exit 1
interval: 5m
start_interval: 30s
start_period: 5m
command: ["postgres", "-c", "shared_preload_libraries=vectors.so", "-c", 'search_path="$$user", public, vectors', "-c", "logging_collector=on", "-c", "max_wal_size=2GB", "-c", "shared_buffers=512MB", "-c", "wal_compression=on"]
restart: alwaysYour .env content
UPLOAD_LOCATION=/srv/immich-app/library
DB_DATA_LOCATION=/srv/immich-app/postgres
IMMICH_VERSION=release
DB_PASSWORD=Redacted
DB_USERNAME=postgres
DB_DATABASE_NAME=immichReproduction steps
- Install v1.132.0 of the immich app and server
- Log in using OAuth, complete login on the provider
- Screen switches back to the server selection screen with an error in the logs
Relevant log output
Missing authentication, server, or endpoint info from the local store
Unable to login using offline or online methods - Logging out completely
Error Logging outAdditional information
OAuth configuration from Immich :
ISSUER URL *
CLIENT ID *
an ID
CLIENT SECRET *
the right secret
SCOPE *
openid email profile picture
SIGNING ALGORITHM *
RS256
PROFILE SIGNING ALGORITHM *
none
STORAGE LABEL CLAIM *
STORAGE QUOTA CLAIM *
immich_quota
DEFAULT STORAGE QUOTA (GIB) *
0
BUTTON TEXT
Login with PocketID
AUTO REGISTER
False
AUTO LAUNCH
False
MOBILE REDIRECT URI OVERRIDE
False
Provider side :
CallBack URLs
https://photo.mydomain.fr/auth/login
app.immich:///oauth-callback
Activity
bo0tzz commentedon Apr 23, 2025
How did you install the app?
Etienne-bdt commentedon Apr 23, 2025
app-release.apk from the 1.132.0 release
(uninstalled previous one to avoid conflict)
aviv926 commentedon Apr 23, 2025
Closed as duplicate.
Answer in this case:
#17827 (comment)
Etienne-bdt commentedon Apr 23, 2025
By all means I don't see why you would close that issue as duplicate @aviv926. As mentioned both in the 1.132.0 discussion with @alextran1502 and in my report here, the app is the most up to date as I installed it straight from GitHub unlike #17827
danieldietzler commentedon Apr 23, 2025
Nope @aviv926, they're saying they're using the latest version.
aviv926 commentedon Apr 23, 2025
I'm confused, so the problem isn't due to the version of the app according to what Zack wrote?
Caelanj commentedon Apr 24, 2025
Correct, the issue occurs even with same version of app and server.
zedocrob commentedon Apr 24, 2025
Updated 1.132.1 apk from github but Oauth2 not working now with Authelia on mobile. (docker latest)
Also had to change
token_endpoint_auth_method: 'client_secret_basicentry totoken_endpoint_auth_method: 'client_secret_postsince 1.132.0 in Authelia config.alextran1502 commentedon Apr 24, 2025
@zedocrob after changing it, does it work?
Rhyn commentedon Apr 24, 2025
No, that only fixes the web auth, the app still doesn't work
In the authelia log i can see this error:
Access Request failed with error: The provided authorization grant (e.g., authorization code, resource owner credentials) or refresh token is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client. The PKCE code verifier must only contain [a-Z], [0-9], '-', '.', '_', '~'." method=POST path=/api/oidc/token remote_ip=xx.xx.xx.xx
DAS-Grim commentedon Apr 25, 2025
Like lucienastie reported in the closed 17864 "duplicate" issue I'm seeing 500 errors using OAuth in general, not just the mobile apps. I'm using Entra as the provider and it works fine if I roll the Immich docker back to v1.131.3 it starts working again. So seems to be an issue in the update unless there is just some change that now needs to be made to get it working again.
alextran1502 commentedon Apr 25, 2025
For those that have OAutb error. Can you help showing your detailed OAuth setup (screenshot would be best), please blur out the secrets so that we can replicate and troubleshoot the issue?
16 remaining items
Str1atum commentedon Apr 26, 2025
Thanks, that brought web OAuth login back to life
jrasm91 commentedon Apr 27, 2025
I believe we will do a release Monday morning
ilopmar commentedon Apr 27, 2025
Oauth login in web also failed for me. I've changed this (as mentioned in this thread):
And now it works in web :)
You to double check. Do we need to keep
token_endpoint_auth_method: 'client_secret_post since'or is it just a temporary workaround?nebb00 commentedon Apr 28, 2025
Any ideas how I do this, when I cannot login (i disabled password auth)
SamsiFPV commentedon Apr 28, 2025
@nebb00 You have to change the
token_endpoint_auth_methodin your authelia config. No changes in immich, except waiting for the fix for the mobile app.nebb00 commentedon Apr 28, 2025
Perfect thanks, all working. Turns out i didnt even have
token_endpoint_auth_methodset for immich at allDAS-Grim commentedon Apr 29, 2025
The Web failures have not been fixed I still can't log in to the Web with OAuth using Entra as the provider on 1.132.3. As far as I can find the change some People are using to get web working agian isnt possible with Entra
Etienne-bdt commentedon Apr 29, 2025
I used pocketID with no issues, I don't know if you have pkce enabled but it has prevented me from login in when I set it up.
And I too couldn't do the token basic/post change
DAS-Grim commentedon Apr 29, 2025
I don't believe PKCE is setup. I have opened issue #17958 for the problem
Plungestep commentedon Jun 3, 2025
I installed the latest .apk file on Android from GitHub, and I’m using OAuth (Authentik). App version is 1.134.0. Immich on my sever is 1.134.0.
I get a “Redirect URI Error - The request fails due to a missing, invalid, or mismatching redirection URI (redirect_uri)” error once the Authentik page loads. I can then “Go home” on Authentik’s site and sign in correctly and open Immich, but the App doesn’t remember the logged-in state. When I go back to the app, it says “Platform exception (Canceled, user canceled login, null, null)”. Except I didn’t cancel the login, I successfully authenticated in Authentik.
Any ideas? Is this related?
jrasm91 commentedon Jun 3, 2025
You might have missed the breaking changes here: #12151
The mobile app requires Authentik to include the
app.immich:///oauth-callbackredirect url. Once that is listed, you should be able to login.Plungestep commentedon Jun 4, 2025
That was my issue, thanks! I wasn't aware that I could have two Redirect URIs, one for the web and one for mobile.
MeikelLP commentedon Aug 5, 2026
I have this issue since 3.x only on mobile.
I have the callback url set to
app.immich:///oauth-callbackand it worked with < 3.x but broke since thenLogin in browser works as expected. Only the app is broken.
I found not logs neither in Immich nor in keycloak
The app logs:
Edit: found the issue:
I'm using URL Checker as default "browser" which redirects to Brave. The redirection triggers the app to "close" and Immich thinks the auth was canceled