immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-07-25 14:00:45 +03:00
Code Issues 783 Packages Projects Releases 22 Wiki Activity

OAuth fails after upgrade to 1.136 #6556

New Issue
Closed
opened 2026-02-05 12:22:25 +03:00 by OVERLORD · 1 comment
OVERLORD commented 2026-02-05 12:22:25 +03:00
Owner
Copy Link

Originally created by @EinToni on GitHub (Jul 25, 2025).

I have searched the existing issues, both open and closed, to make sure this is not a duplicate report.

  • Yes

The bug

After updating to 1.136 the oauth (via authelia) fails on web and mobile with the following message in the authelia logs:

    time=2025-07-25T11:58:27+02:00
    level=error
    msg=Access Request failed with error: Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The request was determined to be using 'token_endpoint_auth_method' method 'client_secret_post', however the OAuth 2.0 client registration does not allow this method. The registered client with id 'immich' is configured to only support 'token_endpoint_auth_method' method 'client_secret_basic'. Either the Authorization Server client registration will need to have the 'token_endpoint_auth_method' updated to 'client_secret_post' or the Relying Party will need to be configured to use 'client_secret_basic'.
    method=POST
    path=/api/oidc/token

Was something regarding the OAuth changed in 1.136?

The OS that Immich Server is running on

docker

Version of Immich Server

1.136

Version of Immich Mobile App

1.136

Platform with the issue

  • Server
  • Web
  • Mobile

Your docker-compose.yml content

nothing interesting

Your .env content

nothing interesting

Reproduction steps

  1. Update to 1.136
  2. Try to log in via OAuth

Relevant log output

Additional information

No response

Originally created by @EinToni on GitHub (Jul 25, 2025). ### I have searched the existing issues, both open and closed, to make sure this is not a duplicate report. - [x] Yes ### The bug After updating to 1.136 the oauth (via authelia) fails on web and mobile with the following message in the authelia logs: ``` time=2025-07-25T11:58:27+02:00 level=error msg=Access Request failed with error: Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The request was determined to be using 'token_endpoint_auth_method' method 'client_secret_post', however the OAuth 2.0 client registration does not allow this method. The registered client with id 'immich' is configured to only support 'token_endpoint_auth_method' method 'client_secret_basic'. Either the Authorization Server client registration will need to have the 'token_endpoint_auth_method' updated to 'client_secret_post' or the Relying Party will need to be configured to use 'client_secret_basic'. method=POST path=/api/oidc/token ``` Was something regarding the OAuth changed in 1.136? ### The OS that Immich Server is running on docker ### Version of Immich Server 1.136 ### Version of Immich Mobile App 1.136 ### Platform with the issue - [ ] Server - [x] Web - [x] Mobile ### Your docker-compose.yml content ```YAML nothing interesting ``` ### Your .env content ```Shell nothing interesting ``` ### Reproduction steps 1. Update to 1.136 2. Try to log in via OAuth ### Relevant log output ```shell ``` ### Additional information _No response_
OVERLORD commented 2026-02-05 12:22:28 +03:00
Author
Owner
Copy Link

@EinToni commented on GitHub (Jul 25, 2025):

Edit: I saw that the integration page in the authelia docs got updated with additional settings: https://www.authelia.com/integration/openid-connect/immich/
After adjusting this it works again.

I think it would be good to also note something like this in the release notes.

@EinToni commented on GitHub (Jul 25, 2025): Edit: I saw that the integration page in the authelia docs got updated with additional settings: https://www.authelia.com/integration/openid-connect/immich/ After adjusting this it works again. I think it would be good to also note something like this in the release notes.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:skip
changelog:translation
cli
date-time
dependencies
documentation
external-library
format
good first issue
mobile-beta
mobile-beta
mobile-beta
needs-answer
nice to have
pull-request
Mirrored from GitHub Pull Request
 sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#6556
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?