#Wrong redirect after oAuth success

1 messages · Page 1 of 1 (latest)

lament karma
#

Why would Immic try to load /api/oauth/callback after an oAuth? That URL does not exist at all.

{
    "message": "Failed to finish oauth",
    "error": "Internal Server Error",
    "statusCode": 500,
    "correlationId": "p0n02pvf"
}

{"message":"Cannot GET /api/oauth/callback","error":"Not Found","statusCode":404,"correlationId":"cufthogg"}

Referrer is the domain on which immich runs, oAuth correctly logs in, no problem with that, but somehow immmich loads that weird url, then says :could not complete oauth: even if everything went well with oAuth (well, except that it did not log in, due to the bad url redirect)

Using authentik as per the docs, everything setup properly according the documentation, this happens on desktop computers, mobile I did not try.

cunning sphinxBOT
#

:wave: Hey @lament karma,

Thanks for reaching out to us. Please carefully read this message and follow the recommended actions. This will help us be more effective in our support effort and leave more time for building Immich immich.

References

#

Checklist

I have...

  1. :ballot_box_with_check: verified I'm on the latest release(note that mobile app releases may take some time).
  2. :ballot_box_with_check: read applicable release notes.
  3. :ballot_box_with_check: reviewed the FAQs for known issues.
  4. :ballot_box_with_check: reviewed Github for known issues.
  5. :ballot_box_with_check: tried accessing Immich via local ip (without a custom reverse proxy).
  6. :ballot_box_with_check: uploaded the relevant information (see below).
  7. :ballot_box_with_check: tried an incognito window, disabled extensions, cleared mobile app cache, logged out and back in, different browsers, etc. as applicable

(an item can be marked as "complete" by reacting with the appropriate number)

Information

In order to be able to effectively help you, we need you to provide clear information to show what the problem is. The exact details needed vary per case, but here is a list of things to consider:

  • Your docker-compose.yml and .env files.
  • Logs from all the containers and their status (see above).
  • All the troubleshooting steps you've tried so far.
  • Any recent changes you've made to Immich or your system.
  • Details about your system (both software/OS and hardware).
  • Details about your storage (filesystems, type of disks, output of commands like fdisk -l and df -h).
  • The version of the Immich server, mobile app, and other relevant pieces.
  • Any other information that you think might be relevant.

Please paste files and logs with proper code formatting, and especially avoid blurry screenshots.
Without the right information we can't work out what the problem is. Help us help you ;)

If this ticket can be closed you can use the /close command, and re-open it later if needed.

cunning sphinxBOT
lapis sorrel
lament karma
#

yes, and my other authentik instances work (gitea, etc)
That example file btw is wrong: it says to put issuer url to https://example.immich.app/application/o/immich/.well-known/openid-configuration which clearly cannot be 🙂

#

The issuer url has to be the issuer of ID, not consumer
Anyway, that apart, the authenication is not at fault.
Immich redirects after authentication on authentik was success, and after said redirects back to immic... to /api/oauth/callback wich is a non existing url.

stray briar
#

example.immich.app is just an example placeholder for the IDP url

#

/api/oauth/callback is a valid & existing endpoint on the Immich server

lament karma
#

yes... that much was clear, but it kind of insinuates you expect it on the same url as immich is.

#

not so much here. how comes this difference?

Screenshot_2025-04-10_at_17.51.47.png
stray briar
#

Because you're trying to open it in your browser which sends a GET

lament karma
#

do I have to re-install perhaps?
I recall some updates where a bit of a ----- at some point, where I somehow managed to get it back up running...

stray briar
#

It only handles POST requests

lament karma
#

well. but after authentik it also goes with error (and that is not in the browser)

#

{
"message": "Failed to finish oauth",
"error": "Internal Server Error",
"statusCode": 500,
"correlationId": "p0n02pvf"
}

stray briar
#

"Internal server error" means the actual error will be in the logs

lament karma
#

so you are saying that redirect is expected and that it should log me in, or let me connect to an existing account after it?

stray briar
#

I'm saying you should check the logs

lament karma
#

yeah the hell....
[Nest] 17 - 04/10/2025, 8:35:04 PM ERROR [Api:ErrorInterceptor~iifrkauo] Unknown error: RPError: failed to decode JWT (TypeError: encrypted JWTs cannot be decoded)
do not enable an Encryption Key in Authentik!!!