immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-03-01 11:20:12 +03:00
Code Issues 783 Packages Projects Releases 12 Wiki Activity

[PR #207] [CLOSED] OAuth2.0/OIDC implementation #8513

New Issue
Closed
opened 2026-02-05 13:48:34 +03:00 by OVERLORD · 0 comments
OVERLORD commented 2026-02-05 13:48:34 +03:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/immich-app/immich/pull/207
Author: @EnricoBilla
Created: 6/7/2022
Status: ❌ Closed

Base: main ← Head: dev/oauth2

📝 Commits (10+)

  • 97a5da2 postgres and redis host from env, discovery url
  • a4f27e1 backend signup with oauth, possibility to disable local users
  • e08e67b revert unneeded change
  • a019b2c api to retrieve access token from auth code, various fix
  • 94e06a1 redis host and port fallback for backward compatibility
  • 5375167 add oauth2 validation, jwt and oauth2 working together
  • a5e4918 refactor
  • 26edd8a merge from upstream
  • 8058e6d fix merge tests, fix login params
  • f8bc6be fix signup

📊 Changes

69 files changed (+6881 additions, -3324 deletions)

View changed files

📝 mobile/android/app/build.gradle (+3 -0)
📝 mobile/ios/Runner/Info.plist (+12 -3)
📝 mobile/lib/constants/hive_box.dart (+6 -3)
📝 mobile/lib/main.dart (+1 -1)
➕ mobile/lib/modules/login/models/login_params_response.model.dart (+83 -0)
📝 mobile/lib/modules/login/models/login_response.model.dart (+1 -1)
➕ mobile/lib/modules/login/models/validate_token_response.model.dart (+101 -0)
📝 mobile/lib/modules/login/providers/authentication.provider.dart (+101 -32)
➕ mobile/lib/modules/login/services/local_auth.service.dart (+27 -0)
➕ mobile/lib/modules/login/services/oauth2.service.dart (+75 -0)
📝 mobile/lib/modules/login/ui/login_form.dart (+26 -10)
📝 mobile/lib/routing/auth_guard.dart (+3 -1)
➕ mobile/lib/shared/models/ws_token_response.model.dart (+48 -0)
📝 mobile/lib/shared/providers/websocket.provider.dart (+29 -5)
📝 mobile/lib/shared/services/network.service.dart (+4 -4)
📝 mobile/lib/shared/services/user.service.dart (+1 -4)
📝 mobile/lib/shared/views/splash_screen.dart (+4 -2)
📝 mobile/pubspec.lock (+55 -48)
📝 mobile/pubspec.yaml (+1 -0)
📝 server/.eslintrc.js (+1 -0)

...and 49 more files

📄 Description

Hi all!
I was interested in implementing OAuth2.0/OIDC login in Immich as discussed in #33. I gave it a try and after all I adapted the backend to use OAuth2 in combination with the local authentication that was already implemented; here are the details for now.

Instructions removed, please take a look at this message for updated instructions

I've marked this as a draft pull request because I need to work on the mobile app and on the web interface before it's fully working.
Before working on that tho, I wanted to discuss with you some topics.

First of all is the expected behaviour when migrating an already existing instance of Immich to use OAuth2. I was thinking that when an user first access to Immich with a valid OAuth2 access token, his local account would be disabled and he has to continue using the OAuth from that point on. What do you think about that?

Second is if we should keep the possibility of having both local and OAuth authentication working together at all. I kept them as most separate as possible to be fully flexible, but being very easy to fix I dismissed the problem for later.

Last one is about the admin account. For what I've seen from latest commits an admin account has been created in order to create new users and while using OAuth2 this function is not needed. Is it planned to have more admin functions so that it does make sense to implement a way of distinguishing admin accounts with OAuth (through scopes for example)?

Let me know what you think about this 😄

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/immich-app/immich/pull/207 **Author:** [@EnricoBilla](https://github.com/EnricoBilla) **Created:** 6/7/2022 **Status:** ❌ Closed **Base:** `main` ← **Head:** `dev/oauth2` --- ### 📝 Commits (10+) - [`97a5da2`](https://github.com/immich-app/immich/commit/97a5da20cbf481920db619a2e54a58b204797fa7) postgres and redis host from env, discovery url - [`a4f27e1`](https://github.com/immich-app/immich/commit/a4f27e1f0ecdf13375227cac7791a88f9dfca53a) backend signup with oauth, possibility to disable local users - [`e08e67b`](https://github.com/immich-app/immich/commit/e08e67b4914559e86fbd5ae2f2b34199b670bf61) revert unneeded change - [`a019b2c`](https://github.com/immich-app/immich/commit/a019b2ca86d0d5df9f8dca6e88d02a4d3bb5c005) api to retrieve access token from auth code, various fix - [`94e06a1`](https://github.com/immich-app/immich/commit/94e06a1c636d004cd54366e6787e4c893a4533ee) redis host and port fallback for backward compatibility - [`5375167`](https://github.com/immich-app/immich/commit/5375167568099141bb38c69d88b05d50e3f0a1ff) add oauth2 validation, jwt and oauth2 working together - [`a5e4918`](https://github.com/immich-app/immich/commit/a5e491889b5cdcfb976e08771ea746c843cb37ea) refactor - [`26edd8a`](https://github.com/immich-app/immich/commit/26edd8aa1d82ec233ee0ddc5e83b68d58fd5a4b5) merge from upstream - [`8058e6d`](https://github.com/immich-app/immich/commit/8058e6d491e9362d312db222cb3ac2396b3463b0) fix merge tests, fix login params - [`f8bc6be`](https://github.com/immich-app/immich/commit/f8bc6be08b6c415f54d361aac90adda2d2b27ef2) fix signup ### 📊 Changes **69 files changed** (+6881 additions, -3324 deletions) <details> <summary>View changed files</summary> 📝 `mobile/android/app/build.gradle` (+3 -0) 📝 `mobile/ios/Runner/Info.plist` (+12 -3) 📝 `mobile/lib/constants/hive_box.dart` (+6 -3) 📝 `mobile/lib/main.dart` (+1 -1) ➕ `mobile/lib/modules/login/models/login_params_response.model.dart` (+83 -0) 📝 `mobile/lib/modules/login/models/login_response.model.dart` (+1 -1) ➕ `mobile/lib/modules/login/models/validate_token_response.model.dart` (+101 -0) 📝 `mobile/lib/modules/login/providers/authentication.provider.dart` (+101 -32) ➕ `mobile/lib/modules/login/services/local_auth.service.dart` (+27 -0) ➕ `mobile/lib/modules/login/services/oauth2.service.dart` (+75 -0) 📝 `mobile/lib/modules/login/ui/login_form.dart` (+26 -10) 📝 `mobile/lib/routing/auth_guard.dart` (+3 -1) ➕ `mobile/lib/shared/models/ws_token_response.model.dart` (+48 -0) 📝 `mobile/lib/shared/providers/websocket.provider.dart` (+29 -5) 📝 `mobile/lib/shared/services/network.service.dart` (+4 -4) 📝 `mobile/lib/shared/services/user.service.dart` (+1 -4) 📝 `mobile/lib/shared/views/splash_screen.dart` (+4 -2) 📝 `mobile/pubspec.lock` (+55 -48) 📝 `mobile/pubspec.yaml` (+1 -0) 📝 `server/.eslintrc.js` (+1 -0) _...and 49 more files_ </details> ### 📄 Description Hi all! I was interested in implementing OAuth2.0/OIDC login in Immich as discussed in #33. I gave it a try and after all I adapted the backend to use OAuth2 in combination with the local authentication that was already implemented; here are the details for now. _Instructions removed, please take a look at [this message](https://github.com/alextran1502/immich/pull/207#issuecomment-1159510134) for updated instructions_ ------ I've marked this as a draft pull request because I need to work on the mobile app and on the web interface before it's fully working. Before working on that tho, I wanted to discuss with you some topics. First of all is the expected behaviour when migrating an already existing instance of Immich to use OAuth2. I was thinking that when an user first access to Immich with a valid OAuth2 access token, his local account would be disabled and he has to continue using the OAuth from that point on. What do you think about that? Second is if we should keep the possibility of having both local and OAuth authentication working together at all. I kept them as most separate as possible to be fully flexible, but being very easy to fix I dismissed the problem for later. Last one is about the admin account. For what I've seen from latest commits an admin account has been created in order to create new users and while using OAuth2 this function is not needed. Is it planned to have more admin functions so that it does make sense to implement a way of distinguishing admin accounts with OAuth (through scopes for example)? Let me know what you think about this 😄 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
OVERLORD added the pull-request label 2026-02-05 13:48:34 +03:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:skip
changelog:translation
cli
date-time
dependencies
documentation
external-library
format
good first issue
mobile-beta
mobile-beta
mobile-beta
needs-answer
nice to have
pull-request
Mirrored from GitHub Pull Request
 sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#8513
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?