immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-07-25 14:00:45 +03:00
Code Issues 783 Packages Projects Releases 22 Wiki Activity

ios app: signin with openId / keycloak no longer working #4906

New Issue
Closed
opened 2026-02-05 10:59:00 +03:00 by OVERLORD · 4 comments
OVERLORD commented 2026-02-05 10:59:00 +03:00
Owner
Copy Link

Originally created by @mamerrem on GitHub (Dec 9, 2024).

The bug

since friday i cant sign in to the immich app on ios (version 1.122.2) using my keycloak openId connect sign in flow.
Browser and android seems to be working fine.

Any ideas on how to fix this issue?

screenshot of env variables (variable immich_version no longer used):
image

The OS that Immich Server is running on

ubunu 22.04

Version of Immich Server

v1.122.2

Version of Immich Mobile App

v1.122.2

Platform with the issue

  • Server
  • Web
  • Mobile

Your docker-compose.yml content

version: '3.8'
name: immich

services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:release
    volumes:
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
      - /etc/localtime:/etc/localtime:ro
    environment:
      DB_PASSWORD: ${DB_PASSWORD}
      DB_DATABASE_NAME: ${DB_DATABASE_NAME}
      DB_HOSTNAME: ${DB_HOSTNAME}
      DB_USERNAME: ${DB_USERNAME}
      REDIS_HOSTNAME: redis
      IMMICH_METRICS: true
      VIRTUAL_PORT: 2283
      VIRTUAL_HOST: ${url}
      LETSENCRYPT_HOST: ${url}
    depends_on:
      - redis
      - database
    restart: always
    networks:
      - immich-backend
      - net
      - redis-backend
    labels:
      - "com.centurylinklabs.watchtower.enable=true"



  immich-machine-learning:
    container_name: immich_machine_learning
    image: ghcr.io/immich-app/immich-machine-learning:release
    ports:
      - 3003:3003
    volumes:
      - model-cache:/cache
    restart: always
    networks:
      - immich-backend
    labels:
      - "com.centurylinklabs.watchtower.enable=true"

  redis:
    container_name: redis
    image: registry.hub.docker.com/library/redis:6.2-alpine
    restart: always
    ports:
      - 6379:6379
    networks:
#      - immich-backend
      - redis-backend
    labels:
      - "com.centurylinklabs.watchtower.enable=true"

  database:
    container_name: immich_postgres
    image: registry.hub.docker.com/tensorchord/pgvecto-rs:pg14-v0.2.0
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
    volumes:
      - pgdata:/var/lib/postgresql/data
    restart: always
    networks:
      - immich-backend
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
      
  backup:
    container_name: immich_db_dumper
    image: prodrigestivill/postgres-backup-local:14
    restart: unless-stopped
    environment:
      POSTGRES_HOST: database
      POSTGRES_CLUSTER: 'TRUE'
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_DB: ${DB_DATABASE_NAME}
      SCHEDULE: "@daily"
      POSTGRES_EXTRA_OPTS: '--clean --if-exists'
      BACKUP_DIR: /db_dumps
    volumes:
      - /data/apps/immich/backup/db_dumps:/db_dumps
    depends_on:
      - database
    networks:
      - immich-backend
    labels:
      - "com.centurylinklabs.watchtower.enable=true"

volumes:
  pgdata:
  model-cache:

networks:
  net:
    external: true
  immich-backend:
  redis-backend:
    external: true

Your .env content

look at description screenshot

Reproduction steps

1.open mobile app
2. enter url of server
3. klick on sign in
4. klick on Keycloak (openId path)
5. internal server error message (message originates from keycloak)
2024-12-09 10:06:52,784 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (executor-thread-79) Uncaught server error: java.lang.RuntimeException: empty host name
...

Relevant log output

2024-12-09 10:06:52,784 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (executor-thread-79) Uncaught server error: java.lang.RuntimeException: empty host name

	at org.keycloak.common.util.KeycloakUriBuilder.buildString(KeycloakUriBuilder.java:464)

	at org.keycloak.common.util.KeycloakUriBuilder.buildFromValuesAsString(KeycloakUriBuilder.java:635)

	at org.keycloak.common.util.KeycloakUriBuilder.buildAsString(KeycloakUriBuilder.java:611)

	at org.keycloak.protocol.oidc.utils.RedirectUtils.decodeRedirectUri(RedirectUtils.java:216)

	at org.keycloak.protocol.oidc.utils.RedirectUtils.verifyRedirectUri(RedirectUtils.java:115)

	at org.keycloak.protocol.oidc.utils.RedirectUtils.verifyRedirectUri(RedirectUtils.java:63)

	at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpointChecker.checkRedirectUri(AuthorizationEndpointChecker.java:129)

	at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.process(AuthorizationEndpoint.java:151)

	at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.buildGet(AuthorizationEndpoint.java:113)

	at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint$quarkusrestinvoker$buildGet_4b690b27439f19dd29733dc5fd4004f24de0adb6.invoke(Unknown Source)

	at org.jboss.resteasy.reactive.server.handlers.InvocationHandler.handle(InvocationHandler.java:29)

	at io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:141)

	at org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:145)

	at io.quarkus.vertx.core.runtime.VertxCoreRecorder$14.runWith(VertxCoreRecorder.java:576)

	at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)

	at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)

	at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:29)

	at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:29)

	at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)

	at java.base/java.lang.Thread.run(Thread.java:840)



App logs:
Received Authorization URL: https://XXXXX.sso.de/realms/XXXXXXXXXXXX/protocol/openid-connect/auth?client_id=immich&scope=openid%20email%20profile&response_type=code&redirect_uri=app.immich%3A%2F%2F%2Foauth-callback&state=LoOGTniiyWkZCPJnb5LDoFaCUv56craD8MWEgmvnpDQ

Additional information

No response

Originally created by @mamerrem on GitHub (Dec 9, 2024). ### The bug since friday i cant sign in to the immich app on ios (version 1.122.2) using my keycloak openId connect sign in flow. Browser and android seems to be working fine. Any ideas on how to fix this issue? screenshot of env variables (variable immich_version no longer used): ![image](https://github.com/user-attachments/assets/132f8678-d334-4590-879f-ecbb43234449) ### The OS that Immich Server is running on ubunu 22.04 ### Version of Immich Server v1.122.2 ### Version of Immich Mobile App v1.122.2 ### Platform with the issue - [ ] Server - [ ] Web - [X] Mobile ### Your docker-compose.yml content ```YAML version: '3.8' name: immich services: immich-server: container_name: immich_server image: ghcr.io/immich-app/immich-server:release volumes: - ${UPLOAD_LOCATION}:/usr/src/app/upload - /etc/localtime:/etc/localtime:ro environment: DB_PASSWORD: ${DB_PASSWORD} DB_DATABASE_NAME: ${DB_DATABASE_NAME} DB_HOSTNAME: ${DB_HOSTNAME} DB_USERNAME: ${DB_USERNAME} REDIS_HOSTNAME: redis IMMICH_METRICS: true VIRTUAL_PORT: 2283 VIRTUAL_HOST: ${url} LETSENCRYPT_HOST: ${url} depends_on: - redis - database restart: always networks: - immich-backend - net - redis-backend labels: - "com.centurylinklabs.watchtower.enable=true" immich-machine-learning: container_name: immich_machine_learning image: ghcr.io/immich-app/immich-machine-learning:release ports: - 3003:3003 volumes: - model-cache:/cache restart: always networks: - immich-backend labels: - "com.centurylinklabs.watchtower.enable=true" redis: container_name: redis image: registry.hub.docker.com/library/redis:6.2-alpine restart: always ports: - 6379:6379 networks: # - immich-backend - redis-backend labels: - "com.centurylinklabs.watchtower.enable=true" database: container_name: immich_postgres image: registry.hub.docker.com/tensorchord/pgvecto-rs:pg14-v0.2.0 environment: POSTGRES_PASSWORD: ${DB_PASSWORD} POSTGRES_USER: ${DB_USERNAME} POSTGRES_DB: ${DB_DATABASE_NAME} volumes: - pgdata:/var/lib/postgresql/data restart: always networks: - immich-backend labels: - "com.centurylinklabs.watchtower.enable=true" backup: container_name: immich_db_dumper image: prodrigestivill/postgres-backup-local:14 restart: unless-stopped environment: POSTGRES_HOST: database POSTGRES_CLUSTER: 'TRUE' POSTGRES_USER: ${DB_USERNAME} POSTGRES_PASSWORD: ${DB_PASSWORD} POSTGRES_DB: ${DB_DATABASE_NAME} SCHEDULE: "@daily" POSTGRES_EXTRA_OPTS: '--clean --if-exists' BACKUP_DIR: /db_dumps volumes: - /data/apps/immich/backup/db_dumps:/db_dumps depends_on: - database networks: - immich-backend labels: - "com.centurylinklabs.watchtower.enable=true" volumes: pgdata: model-cache: networks: net: external: true immich-backend: redis-backend: external: true ``` ### Your .env content ```Shell look at description screenshot ``` ### Reproduction steps 1.open mobile app 2. enter url of server 3. klick on sign in 4. klick on Keycloak (openId path) 5. internal server error message (message originates from keycloak) `2024-12-09 10:06:52,784 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (executor-thread-79) Uncaught server error: java.lang.RuntimeException: empty host name` ... ### Relevant log output ```shell 2024-12-09 10:06:52,784 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (executor-thread-79) Uncaught server error: java.lang.RuntimeException: empty host name at org.keycloak.common.util.KeycloakUriBuilder.buildString(KeycloakUriBuilder.java:464) at org.keycloak.common.util.KeycloakUriBuilder.buildFromValuesAsString(KeycloakUriBuilder.java:635) at org.keycloak.common.util.KeycloakUriBuilder.buildAsString(KeycloakUriBuilder.java:611) at org.keycloak.protocol.oidc.utils.RedirectUtils.decodeRedirectUri(RedirectUtils.java:216) at org.keycloak.protocol.oidc.utils.RedirectUtils.verifyRedirectUri(RedirectUtils.java:115) at org.keycloak.protocol.oidc.utils.RedirectUtils.verifyRedirectUri(RedirectUtils.java:63) at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpointChecker.checkRedirectUri(AuthorizationEndpointChecker.java:129) at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.process(AuthorizationEndpoint.java:151) at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.buildGet(AuthorizationEndpoint.java:113) at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint$quarkusrestinvoker$buildGet_4b690b27439f19dd29733dc5fd4004f24de0adb6.invoke(Unknown Source) at org.jboss.resteasy.reactive.server.handlers.InvocationHandler.handle(InvocationHandler.java:29) at io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:141) at org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:145) at io.quarkus.vertx.core.runtime.VertxCoreRecorder$14.runWith(VertxCoreRecorder.java:576) at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513) at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538) at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:29) at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:29) at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) at java.base/java.lang.Thread.run(Thread.java:840) App logs: Received Authorization URL: https://XXXXX.sso.de/realms/XXXXXXXXXXXX/protocol/openid-connect/auth?client_id=immich&scope=openid%20email%20profile&response_type=code&redirect_uri=app.immich%3A%2F%2F%2Foauth-callback&state=LoOGTniiyWkZCPJnb5LDoFaCUv56craD8MWEgmvnpDQ ``` ### Additional information _No response_
OVERLORD commented 2026-02-05 10:59:03 +03:00
Author
Owner
Copy Link

@bo0tzz commented on GitHub (Dec 9, 2024):

This is a keycloak bug, you should update your keycloak installation.

@bo0tzz commented on GitHub (Dec 9, 2024): This is a keycloak bug, you should update your keycloak installation.
OVERLORD commented 2026-02-05 10:59:03 +03:00
Author
Owner
Copy Link

@mamerrem commented on GitHub (Dec 11, 2024):

The issue only exists when trying to log in via iOS app and every other platform works perfectly. Did anything change with the opened logic in the last couple of days?

@mamerrem commented on GitHub (Dec 11, 2024): The issue only exists when trying to log in via iOS app and every other platform works perfectly. Did anything change with the opened logic in the last couple of days?
OVERLORD commented 2026-02-05 10:59:04 +03:00
Author
Owner
Copy Link

@bo0tzz commented on GitHub (Dec 11, 2024):

Not that recently, no: #12246

@bo0tzz commented on GitHub (Dec 11, 2024): Not that recently, no: #12246
OVERLORD commented 2026-02-05 10:59:05 +03:00
Author
Owner
Copy Link

@mamerrem commented on GitHub (Dec 11, 2024):

I checked the logs and realized that my setup was quite complicated (and keykloak patches were not applied). Resolved the issues and everything is working smoothly again.

@mamerrem commented on GitHub (Dec 11, 2024): I checked the logs and realized that my setup was quite complicated (and keykloak patches were not applied). Resolved the issues and everything is working smoothly again.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:skip
changelog:translation
cli
date-time
dependencies
documentation
external-library
format
good first issue
mobile-beta
mobile-beta
mobile-beta
needs-answer
nice to have
pull-request
Mirrored from GitHub Pull Request
 sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#4906
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?