immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-02-05 00:30:57 +03:00
Code Issues 11 Packages Projects Releases 10 Wiki Activity

[BUG] [OIDC] Don't bind user to E-Mail but to Open ID sub #445

New Issue
Closed
opened 2026-02-04 20:30:49 +03:00 by OVERLORD · 5 comments
OVERLORD commented 2026-02-04 20:30:49 +03:00
Owner
Copy Link

Originally created by @akoyaxd on GitHub (Nov 25, 2022).

Describe the bug
If I use Open ID to login and a user changes the E-Mail in the IDP (like Authentik), Immich creates a new account on the next login

Task List

To Reproduce
Steps to reproduce the behavior:

  1. Install Immich
  2. Setup OAuth accordingly to the docs.
  3. Login with OAuth
  4. Change E-Mail address in the IDP
  5. Logout and Login again to Immich
  6. New user in Immich is created

Expected behavior
Immich recognizes the user by the unique Open ID sub attribute and logs the use in.
Icing on the cake: The E-Mail get's updated in the Immich Database.

System
all

Additional context
My IDP is Authentik

Originally created by @akoyaxd on GitHub (Nov 25, 2022). <!-- Note: Please search to see if an issue already exists for the bug you encountered. --> **Describe the bug** If I use Open ID to login and a user changes the E-Mail in the IDP (like Authentik), Immich creates a new account on the next login **Task List** **To Reproduce** Steps to reproduce the behavior: 1. Install Immich 2. Setup OAuth accordingly to the docs. 3. Login with OAuth 4. Change E-Mail address in the IDP 5. Logout and Login again to Immich 6. New user in Immich is created **Expected behavior** Immich recognizes the user by the unique Open ID `sub` attribute and logs the use in. Icing on the cake: The E-Mail get's updated in the Immich Database. **System** all **Additional context** My IDP is Authentik
OVERLORD commented 2026-02-04 20:31:00 +03:00
Author
Owner
Copy Link

@christiaangoossens commented on GitHub (Dec 3, 2022):

When resolving this, keep in mind the migration from local to OIDC.

If I create an account with an email not using OIDC and then configure OIDC, I want to have that same account used when I login with that email.

Thus, link sub to the user on first login, by first attempting to match email.

@christiaangoossens commented on GitHub (Dec 3, 2022): When resolving this, keep in mind the migration from local to OIDC. If I create an account with an email not using OIDC and then configure OIDC, I want to have that same account used when I login with that email. Thus, link sub to the user on first login, by first attempting to match email.
OVERLORD commented 2026-02-04 20:31:03 +03:00
Author
Owner
Copy Link

@alextran1502 commented on GitHub (Dec 3, 2022):

When resolving this, keep in mind the migration from local to OIDC.

If I create an account with an email not using OIDC and then configure OIDC, I want to have that same account used when I login with that email.

Thus, link sub to the user on first login, by first attempting to match email.

@christiaangoossens I believe you can currently do that already. The OIDC account and the existing email on Immich is "linked"

@alextran1502 commented on GitHub (Dec 3, 2022): > When resolving this, keep in mind the migration from local to OIDC. > > If I create an account with an email not using OIDC and then configure OIDC, I want to have that same account used when I login with that email. > > Thus, link sub to the user on first login, by first attempting to match email. @christiaangoossens I believe you can currently do that already. The OIDC account and the existing email on Immich is "linked"
OVERLORD commented 2026-02-04 20:31:09 +03:00
Author
Owner
Copy Link

@christiaangoossens commented on GitHub (Dec 3, 2022):

When resolving this, keep in mind the migration from local to OIDC.

If I create an account with an email not using OIDC and then configure OIDC, I want to have that same account used when I login with that email.

Thus, link sub to the user on first login, by first attempting to match email.

@christiaangoossens I believe you can currently do that already. The OIDC account and the existing email on Immich is "linked"

That's indeed currently how it works, but changing the claim to sub without additional matching breaks that. Therefore, a solution proposed here should keep not breaking this in mind.

edited: context -> sub is often an arbitrary id

@christiaangoossens commented on GitHub (Dec 3, 2022): > > When resolving this, keep in mind the migration from local to OIDC. > > > > If I create an account with an email not using OIDC and then configure OIDC, I want to have that same account used when I login with that email. > > > > Thus, link sub to the user on first login, by first attempting to match email. > > @christiaangoossens I believe you can currently do that already. The OIDC account and the existing email on Immich is "linked" That's indeed currently how it works, but changing the claim to `sub` without additional matching breaks that. Therefore, a solution proposed here should keep not breaking this in mind. _edited: context -> sub is often an arbitrary id_
OVERLORD commented 2026-02-04 20:31:14 +03:00
Author
Owner
Copy Link

@alextran1502 commented on GitHub (Dec 4, 2022):

@jrasm91 Tagging Jason FYI

@alextran1502 commented on GitHub (Dec 4, 2022): @jrasm91 Tagging Jason FYI
OVERLORD commented 2026-02-04 20:31:21 +03:00
Author
Owner
Copy Link

@jrasm91 commented on GitHub (Dec 4, 2022):

Yeah, this makes sense.

  1. If sub matches, it's a linked user
  2. If email matches, it's the first login for a linked user, so save the sub
  3. Otherwise, register a new user (and save the sub)
@jrasm91 commented on GitHub (Dec 4, 2022): Yeah, this makes sense. 1. If sub matches, it's a linked user 2. If email matches, it's the first login for a linked user, so save the sub 3. Otherwise, register a new user (and save the sub)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:translation
cli
date-time
documentation
external-library
format
good first issue
needs-answer
nice to have
sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#445
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?