ImmichI
Immich•8mo ago
HolyAnatoly

V1.132.3 OAuth Broken

i have been running immich since v1.126.0 upgrading as releases come out. The latest (v1.132.3) seems to have broken my AWS cognito login.

Per the release notes if i had been running Authelia i need to add the config "token_endpoint_auth_method: "client_secret_post". i assume since aws cognito is a similar oauth provider i need to additionally set it in order to get it to work but i do not see the option in the immich admin ui (where i set up my cognito oauth provider).

it is also unclear if i can set it via an environment variable , specifically what that environment variable would be token_endpoint_auth_method? or oauth_token_endpoint_auth_method

setup:
unraid running -> a ubuntu vm -> immich docker compose -> pangolin reverse proxy(traefik under the hood)
~5 clients IOS and Android


logs:

it just enter a sign in loop:

[Nest] 17  - 05/17/2025, 4:11:36 AM   ERROR [Api:ErrorInterceptor~zmnc7abz] Unknown error: ResponseBodyError: server responded with an error in the response body
ResponseBodyError: server responded with an error in the response body
    at checkOAuthBodyError (file:///usr/src/app/node_modules/oauth4webapi/build/index.js:865:19)
    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
    at async processGenericAccessTokenResponse (file:///usr/src/app/node_modules/oauth4webapi/build/index.js:1141:5)
    at async processAuthorizationCodeOAuth2Response (file:///usr/src/app/node_modules/oauth4webapi/build/index.js:1373:20)
    at async authorizationCodeGrant (file:///usr/src/app/node_modules/openid-client/build/index.js:850:18)
    at async OAuthRepository.getProfile (/usr/src/app/dist/repositories/oauth.repository.js:52:28)
    at async AuthService.callback (/usr/src/app/dist/services/auth.service.js:137:25)
    at async OAuthController.finishOAuth (/usr/src/app/dist/controllers/oauth.controller.js:46:22)
[Nest] 17  - 05/17/2025, 4:11:37 AM   ERROR [Api:ErrorInterceptor~4o77ldja] Unknown error: ResponseBodyError: server responded with an error in the response body
ResponseBodyError: server responded with an error in the response body
    at checkOAuthBodyError (file:///usr/src/app/node_modules/oauth4webapi/build/index.js:865:19)
    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
    at async processGenericAccessTokenResponse (file:///usr/src/app/node_modules/oauth4webapi/build/index.js:1141:5)
    at async processAuthorizationCodeOAuth2Response (file:///usr/src/app/node_modules/oauth4webapi/build/index.js:1373:20)
    at async authorizationCodeGrant (file:///usr/src/app/node_modules/openid-client/build/index.js:850:18)
    at async OAuthRepository.getProfile (/usr/src/app/dist/repositories/oauth.repository.js:52:28)
    at async AuthService.callback (/usr/src/app/dist/services/auth.service.js:137:25)
    at async OAuthController.finishOAuth (/usr/src/app/dist/controllers/oauth.controller.js:46:22)
env921B
docker-compose.yaml2.31KB
Was this page helpful?