Immich•2y ago

Authelia login page redirect loop with OIDC/Oauth setup

I set up authelia as oidc provider for immich, but when I login with credentials on the authelia login page, it just redirects back to the same authelia login page. The immich container logs don't show anything either, no errors or anything. The authelia logs show authentication succeeded, authorization request being processed and then the request timing out. I think that immich is somehow unable to route to authelia host, despite me being able to ping and curl the authelia page from inside the immich_server container. I am using local ip for convenience, but i have also tried with domain names and the outcomes are the same. Anyone who has successfully set up oidc with authelia got any tips?

70 Replies

dretyuiopOP•2y ago

docker-compose.yml

stack.env

conf.yml

dretyuiopOP•2y ago

jrasm91•2y ago

That doesn't look like the right issuer url Maybe it is? Does this url work? http://192.168.1.7:9091/.well-known/openid-configuration (If you open it in a browser)

abbhishek_chakra•2y ago

I've it working with authelia. What are the redirect url you have set up for authelia?

dretyuiopOP•2y ago

this is what i got from that page

openid-configuration...

dretyuiopOP•2y ago

redirect_uris: - app.immich:/ - http://192.168.1.7:2283/auth/login - http://192.168.1.7:2283/user-settings also, can i ask what issuer url did you put for the immich configuration?

jrasm91•2y ago

Do you see the oauth button on the Immich login page?

dretyuiopOP•2y ago

Yes, i can click on the oauth button and go to the authelia login page, but after using correct credentials, it just redirects back to the same login page

martabal•2y ago

What is your authelia domain ? I tried with your settings and I have the same problem Did you try with a domain name ?

jrasm91•2y ago

What do you mean by "same login". Do you mean the immich login page?

dretyuiopOP•2y ago

the authelia login page

jrasm91•2y ago

Can you record a video?

dretyuiopOP•2y ago

yeah i tried with domain name, just changing the redirect uri, otherwise settings are the same, same outcome being unable to sign in

jrasm91•2y ago

If it is not redirecting back to immich, it sounds like something is misconfigured. Do you have auto login checked in immich? If so, can you disable it?

martabal•2y ago

Do you use Authelia ? It's supposed to work with a domain name and a reverse proxy.

jrasm91•2y ago

Is that question for me?

martabal•2y ago

No no for @dretyuiop

dretyuiopOP•2y ago

if by auto login you mean auto launch in immich, then yes i have it disabled

jrasm91•2y ago

Do you use authelia with any other applications besides immich?

dretyuiopOP•2y ago

yes i used a domain name, but i encountered the same redirect problem, so i tested my setup on my work machine with local ip for convenience, still facing the same problem. no, other applications i use lldap, you think this is a problem with my authelia setup then?

jrasm91•2y ago

Yes

dretyuiopOP•2y ago

here is a video showing off the problem

jrasm91•2y ago

Well to start with you are using the issuer url of 192.168.1.7 and the video is shows .6

dretyuiopOP•2y ago

yeah my local ip changed cus i was lazy to setup static ip for my work machine, i just changed the settings in immich and authelia to .6. Don't think it matters

jrasm91•2y ago

What you copy/paste the url in the browser on the login path here?

dretyuiopOP•2y ago

You mean the url for immich page? That's http://192.168.1.6:2283/

jrasm91•2y ago

No the whole thing with the query params and all On the authelia login portal

dretyuiopOP•2y ago

http://192.168.1.6:9091/?rd=http%3A%2F%2F192.168.1.6%3A9091%2Fapi%2Foidc%2Fauthorization%3Fclient_id%3Dimmich%26redirect_uri%3Dhttp%253A%252F%252F192.168.1.6%253A2283%252Fauth%252Flogin%26response_type%3Dcode%26scope%3Dopenid%2Bemail%2Bprofile%26state%3DS1I50mqi0Szp-vadzklflRFCyEVhK-77QwckdNBwr54&workflow=openid_connect

jrasm91•2y ago

It looks like immich is redirecting you to:

http://192.168.1.6:2283/auth/login&response_type=code&scope=openid+email+profile&state=S1I50mqi0Szp-vadzklflRFCyEVhK-77QwckdNBwr54&workflow=openid_connect

Which is correct. After that authelia isn't working because of a presumable misconfiguration. I've never used it so can't be of much help. You should check the authelia logs and/or open ask for help with them directly instead.

dretyuiopOP•2y ago

I actually asked for help in the authelia discord, but they weren't that active. Honestly, I was just hoping someone who got authelia oidc working with immich can show their configuration. Thanks anyways though.

jrasm91•2y ago

No problem. I think the issue is definitely related to a setup issue. Maybe you can ask in general-discussion if anybody has a valid configuration they could share or if they could take a look.

Kryptonian•2y ago

Should oAuth even work with IPs and http only?

dretyuiopOP•2y ago

Given that the immich docs have examples for local ip and http in oauth section i would assume so

Allram•2y ago

I have Authelia running with Immich. I have authelia on my domain: https://identity.DOMAIN.org And Immich on: https://photos.DOMAIN.org I don't use local ip's, i only use domain names, but i guess it should work anyway? Authelia Identity_provider config:

 access_token_lifespan: 1h
    authorize_code_lifespan: 1m
    id_token_lifespan: 1h
    refresh_token_lifespan: 90m
    enable_client_debug_messages: false
    clients:
      - id: immich
        description: Immich
        secret: nZr4u7x!A%D*G-KaPdSgVkYp3s5v8yKLDJLKSAJDKLSAJDKLSAJLKDJASLKNDLKASNDLKAUS%D*G-KaPdSgVkYp3s6v9y$B&E)H+MbQeThWmZq4t7w!z%C*F-JaN
        public: false
        authorization_policy: two_factor
        redirect_uris:
          - app.immich:/
          - https://photos.DOMAIN.org/auth/login
          - https://photos.DOMAIN.org/user-settings
        scopes:
          - openid
          - profile
          - email
          - groups
        userinfo_signing_algorithm: none

 access_token_lifespan: 1h
    authorize_code_lifespan: 1m
    id_token_lifespan: 1h
    refresh_token_lifespan: 90m
    enable_client_debug_messages: false
    clients:
      - id: immich
        description: Immich
        secret: nZr4u7x!A%D*G-KaPdSgVkYp3s5v8yKLDJLKSAJDKLSAJDKLSAJLKDJASLKNDLKASNDLKAUS%D*G-KaPdSgVkYp3s6v9y$B&E)H+MbQeThWmZq4t7w!z%C*F-JaN
        public: false
        authorization_policy: two_factor
        redirect_uris:
          - app.immich:/
          - https://photos.DOMAIN.org/auth/login
          - https://photos.DOMAIN.org/user-settings
        scopes:
          - openid
          - profile
          - email
          - groups
        userinfo_signing_algorithm: none

Allram•2y ago

Immich config

Allram•2y ago

it seems like you haven't generated a random string for the encryption key for the database, have you added any users to Authelia (in users_database.yml) and can you log in to Authelia without Immich? you are also using port 8080 on the immich_proxy, tried to change the authelia redirect_uris from 2283 to 8080? And you are sure that 192.168.1.7 is the IP for immich_server? or is that for immich_proxy?

dretyuiopOP•2y ago

i changed the the immich_proxy ports to 8080:8080 and the port in authelia conf file to 8080, still the same situation. The 192.168.1.7 is ip for both immich_server and immich_proxy, because its the host ip If by log in to authelia, you mean if it will redirect me to the default url with the credentials, then yes it did. Copying your oidc section didnt work. Could you share your whole config file (with secrets removed) ?

Allram•2y ago

on the video you sent it doesn't look like you can log into to Authelia even?

dretyuiopOP•2y ago

i logged in, thats why it breifly flickered and redirect back to authelia login page. If the credentials were wrong, it would have a red popup saying the credentials were wrong.

Allram•2y ago

here is my Authelia config with all my secrets and stuff removed. Just note that i run Redis and PostgreSQL Unix sockets and don't use SQlite DB

configuration.yml

Allram•2y ago

This cannot be the same ip for both docker containers, but it should be enough to just point the login to the immich_web container if you don't use the immich_proxy. If you use that you need to point Authelia to the immich_proxy container NVM: Got it, i didn't see that you run it with host IP, tought it was separate IP for each container.

dretyuiopOP•2y ago

It still doesn't work. Thanks anyways though

martabal•2y ago

Does the authelia authentication works ?

dretyuiopOP•2y ago

yeah i can go to the default redirect url in authelia

martabal•2y ago

No I mean this page

martabal•2y ago

dretyuiopOP•2y ago

if u mean the oauth, then no it doesn't work for me i am not sure what that page is, so i am just assuming it is the oauth page

Kryptonian•2y ago

That is Authelia's page after logging in to Authelia.

martabal•2y ago

It’s the home page for authelia When you go to 192.168.1.7:9091 you’re supposed to see this once you’re authenticated

dretyuiopOP•2y ago

I just get redirected to the default_redirection_url once i authenticate in authelia. You guys don't get redirected?

martabal•2y ago

Nope Do you have a authelia_session cookie after the authentication ?

dretyuiopOP•2y ago

no cookies btw what authelia version are you guys using?

martabal•2y ago

This means your Authelia is not set correctly; my advice would be to have the authelia authentication working first, then works on the Immich OAuth Authentication. Authelia is a bit complicated to setup and understand, I recommend reading their documentation (which is amazing) and watching some tutorials The latest ~ 4.37.5

ddshd•2y ago

Also maybe try a different browser

dretyuiopOP•2y ago

Isn't the only thing needed to setup authelia the config file? I did use the authelia docs to write the config file and even just copied it from someone who got oidc working, still no luck.

Allram•2y ago

Can you post your latest authelia config, then we can see if there is anything else that is missing now.

dretyuiopOP•2y ago

Sure, here is the config file. Maybe you guys can try it out and see if it is a authelia configuration problem

conf.yml

Kryptonian•2y ago

default_redirection_url is not needed per se

Allram•2y ago

and you have created a user in users_database.yml? What is the output of your Authelia log? Also when you try to log in? and have you generated a random string of more than 20 characters under 'encryption_key' for storage?

storage:
  encryption_key: 
you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this
  local:
    path: /config/db.sqlite3

storage:
  encryption_key: 
you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this
  local:
    path: /config/db.sqlite3

dretyuiopOP•2y ago

yes when using oauth:

{"level":"debug","method":"POST","msg":"Mark 1FA authentication attempt made by user 'authelia'","path":"/api/firstfactor","remote_ip":"10.89.1.12","time":"2023-08-16T02:11:25+08:00"}
{"level":"debug","method":"POST","msg":"Successful 1FA authentication attempt made by user 'authelia'","path":"/api/firstfactor","remote_ip":"10.89.1.12","time":"2023-08-16T02:11:25+08:00"}
{"level":"debug","method":"GET","msg":"Authorization Request with id 'c68241bb-d3c1-4c3e-9e25-d259031a89e3' on client with id 'immich' is being processed","path":"/api/oidc/authorization","remote_ip":"10.89.1.12","time":"2023-08-16T02:11:26+08:00"}

{"level":"debug","method":"POST","msg":"Mark 1FA authentication attempt made by user 'authelia'","path":"/api/firstfactor","remote_ip":"10.89.1.12","time":"2023-08-16T02:11:25+08:00"}
{"level":"debug","method":"POST","msg":"Successful 1FA authentication attempt made by user 'authelia'","path":"/api/firstfactor","remote_ip":"10.89.1.12","time":"2023-08-16T02:11:25+08:00"}
{"level":"debug","method":"GET","msg":"Authorization Request with id 'c68241bb-d3c1-4c3e-9e25-d259031a89e3' on client with id 'immich' is being processed","path":"/api/oidc/authorization","remote_ip":"10.89.1.12","time":"2023-08-16T02:11:26+08:00"}

when going directly to authelia:

{"level":"debug","method":"POST","msg":"Mark 1FA authentication attempt made by user 'authelia'","path":"/api/firstfactor","remote_ip":"10.89.1.2","time":"2023-08-16T14:21:33+08:00"}
{"level":"debug","method":"POST","msg":"Successful 1FA authentication attempt made by user 'authelia'","path":"/api/firstfactor","remote_ip":"10.89.1.2","time":"2023-08-16T14:21:33+08:00"}

{"level":"debug","method":"POST","msg":"Mark 1FA authentication attempt made by user 'authelia'","path":"/api/firstfactor","remote_ip":"10.89.1.2","time":"2023-08-16T14:21:33+08:00"}
{"level":"debug","method":"POST","msg":"Successful 1FA authentication attempt made by user 'authelia'","path":"/api/firstfactor","remote_ip":"10.89.1.2","time":"2023-08-16T14:21:33+08:00"}

i just used the you_must_generate string itself as the encryption_key, since I was just testing to see if it worked and not deploying it. I can test using an actualy random string though

martabal•2y ago

I thought you were using lldap ?

dretyuiopOP•2y ago

i am testing this on my work machine and using file for convenience. I used lldap when setting up on my server.

martabal•2y ago

Is your authelia authentication working ?

dretyuiopOP•2y ago

no, when i go to the page and authenticate, it just auto redirects to the default url. I posted my config file above, maybe you can see if it is a config problem.

martabal•2y ago

You replaced example.com with your domain right ?

dretyuiopOP•2y ago

No, since i didn't want to set up reverse proxy on my work machine, but i can test using domain name later. But I used domain name on my server and it didn't work before, so i doubt it will now though

martabal•2y ago

I don’t think it’s possible to have authelia working without a domain

martabal•2y ago

Please read https://www.authelia.com/configuration/session/introduction/

Authelia

Session - Configuration

Session Configuration

dretyuiopOP•2y ago

Ok I managed to solve the problem. It was indeed a configuration problem. The session.domain I put immich.example.com instead of just example.com because I didn't read the manual. Thank you to everyone who helped out.

martabal•2y ago

🥳🥳 The hardest part is behind now. Enjoy !

Gaming

Programming

Authelia login page redirect loop with OIDC/Oauth setup

Did you find this page helpful?