immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-02-05 00:30:57 +03:00
Code Issues 13 Packages Projects Releases 10 Wiki Activity

[Feature]: Oauth features #510

New Issue
Closed
opened 2026-02-04 20:58:43 +03:00 by OVERLORD · 7 comments
OVERLORD commented 2026-02-04 20:58:43 +03:00
Owner
Copy Link

Originally created by @Maypul on GitHub (Dec 23, 2022).

Feature detail

Hi there,

it is great to see that Oauth has been implemented, I was wondering if following features are planned:

  1. possibility to choose which User identifier to map
  2. possibility to put each of oauth links separately instead of main one (authorization_endpoint, token_endpoint, userinfo_endpoint, jwks_uri)
  3. allow access based on groups user has assigned from oauth provider

Platform

Web

Originally created by @Maypul on GitHub (Dec 23, 2022). ### Feature detail Hi there, it is great to see that Oauth has been implemented, I was wondering if following features are planned: 1) possibility to choose which User identifier to map 2) possibility to put each of oauth links separately instead of main one (authorization_endpoint, token_endpoint, userinfo_endpoint, jwks_uri) 3) allow access based on groups user has assigned from oauth provider ### Platform Web
OVERLORD commented 2026-02-04 20:58:52 +03:00
Author
Owner
Copy Link

@jrasm91 commented on GitHub (Dec 23, 2022):

What is the benefit or use case for 1 or 2?

3 had been discussed, and could be implemented in the future.

@jrasm91 commented on GitHub (Dec 23, 2022): What is the benefit or use case for 1 or 2? 3 had been discussed, and could be implemented in the future.
OVERLORD commented 2026-02-04 20:59:01 +03:00
Author
Owner
Copy Link

@Maypul commented on GitHub (Dec 23, 2022):

  1. not all my users in my oauth provider have an email, I'd assume that would be an issue? We use a preffered username instead of email for identification which is mandatory, unique field.
  2. With specific setup it would allow to map direct links and now get the default one from well known file. This specific setup, I do have in one instance where we have a local DNS setup and server set up in a way, where if an app would get their config from well known file and the user authenticating in this specific location, it will not work for them. Possiblity to use separate links would allow us to use direct link to these configs would would be resolveable within this specific network, and would work for everyone. I'd say it is edge case, but we do use this setup in other apps (Portainer for example).
@Maypul commented on GitHub (Dec 23, 2022): 1) not all my users in my oauth provider have an email, I'd assume that would be an issue? We use a preffered username instead of email for identification which is mandatory, unique field. 2) With specific setup it would allow to map direct links and now get the default one from well known file. This specific setup, I do have in one instance where we have a local DNS setup and server set up in a way, where if an app would get their config from well known file and the user authenticating in this specific location, it will not work for them. Possiblity to use separate links would allow us to use direct link to these configs would would be resolveable within this specific network, and would work for everyone. I'd say it is edge case, but we do use this setup in other apps (Portainer for example).
OVERLORD commented 2026-02-04 20:59:08 +03:00
Author
Owner
Copy Link

@jrasm91 commented on GitHub (Dec 23, 2022):

Ah, number one is related to auto registration I think? Email is required in immich at the moment and probably always, although with #1154 you could manually link the user (without an email) after creating the accounts in immich.

Number two does sounds like an edge case that could probably be solved with DNS, no? For simplicity we implemented it with one input instead of multiple. It is quite a bit simpler to display, validate, and store just the one, which does work for most people.

@jrasm91 commented on GitHub (Dec 23, 2022): Ah, number one is related to auto registration I think? Email is required in immich at the moment and probably always, although with #1154 you could manually link the user (without an email) after creating the accounts in immich. Number two does sounds like an edge case that could probably be solved with DNS, no? For simplicity we implemented it with one input instead of multiple. It is quite a bit simpler to display, validate, and store just the one, which does work for most people.
OVERLORD commented 2026-02-04 20:59:12 +03:00
Author
Owner
Copy Link

@Maypul commented on GitHub (Dec 24, 2022):

Yes, it's related to autoregistration, I do not think that auto linking tons of users is good, hopefully we will be able to set user identifier :)

About 2, yes, it could be solveable with DNS but that ''core'' issue also comes from DNS setup. It's not feasible to solve it this way, but it is possible to route traffic around (in this case) to make it work. Would not a checkbox near the simple way saying advanced config be elegant and still simple? Checking it would expand options to fill in all separate values.

@Maypul commented on GitHub (Dec 24, 2022): Yes, it's related to autoregistration, I do not think that auto linking tons of users is good, hopefully we will be able to set user identifier :) About 2, yes, it could be solveable with DNS but that ''core'' issue also comes from DNS setup. It's not feasible to solve it this way, but it is possible to route traffic around (in this case) to make it work. Would not a checkbox near the simple way saying advanced config be elegant and still simple? Checking it would expand options to fill in all separate values.
OVERLORD commented 2026-02-04 20:59:20 +03:00
Author
Owner
Copy Link

@jrasm91 commented on GitHub (Dec 24, 2022):

Email is a required field for a user in immich so what value would you use for that? Are you saying you want to put username from your system in the email field in immich? That won't work. So how would specifying a different attribute work? I think the issue is immich requires an email, but your system doesn't have one.

I'm not saying it's not possible. It just requires more work to build that. I can look into it though. A check box for "advanced" vs "automatic" could require all the endpoints instead of just one discovery url.

@jrasm91 commented on GitHub (Dec 24, 2022): Email is a required field for a user in immich so what value would you use for that? Are you saying you want to put username from your system in the email field in immich? That won't work. So how would specifying a different attribute work? I think the issue is immich requires an email, but your system doesn't have one. I'm not saying it's not possible. It just requires more work to build that. I can look into it though. A check box for "advanced" vs "automatic" could require all the endpoints instead of just one discovery url.
OVERLORD commented 2026-02-04 20:59:23 +03:00
Author
Owner
Copy Link

@TokugawaHeavyIndustries commented on GitHub (Dec 26, 2022):

Looks like #1154 will completely solve 1

@TokugawaHeavyIndustries commented on GitHub (Dec 26, 2022): Looks like #1154 will completely solve 1
OVERLORD commented 2026-02-04 20:59:26 +03:00
Author
Owner
Copy Link

@jrasm91 commented on GitHub (Dec 30, 2022):

1 and 2 are not currently planned. 3 is possibly planned, but not until after #1043.

@jrasm91 commented on GitHub (Dec 30, 2022): 1 and 2 are not currently planned. 3 is possibly planned, but not until after #1043.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:translation
cli
date-time
documentation
external-library
format
good first issue
needs-answer
nice to have
sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#510
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?