OAuth2

OAuth 2.0 is an authorization protocol and NOT an authentication protocol. As such, it is designed primarily as a means of granting access to a set of resources, for example, remote APIs or user data. OAuth 2.0 uses Access Tokens.

Troubleshoot

If you are having issues with redirect uri please check the listed items

• Are you accessing the service trough a local ip
  Example 192.168.1.25 or 127.24.4.1
• Have you checked the provider Redirect URIs/Origins (RegEx)
  Head to Applications > Providers > YOR_PROVIDER > Edit to check

Immich

Using Authentik

Provider

1. Go to Applications > Providers
2. Create a new Provider
3. Choose OAuth2/OpenID Provider

• Name: Immich
• Authentication flow: default-authentication-flow
• Authorization flow: default-provider-authorization-explicit-consent
• Redirect URIs/Origins (RegEx):

https://photos.yourdomain.com
https://photos.yourdomain.com.*
http://localhost:2283

4. Make sure you copy the Client ID and Client Secret into notepad
5. Create the provider

for mobile

1. Edit the Provider
2. Scroll down to Redirect URIs/Origins (RegEx)
3. Add URIs

app.immich:///oauth-callback
app.immich:///oauth-callback.*

4. Save the provider and test mobile

Application

1. Go to Applications > Applications
2. Create a new application
3. Use these options

• name: Immich
• slug: photos ( Recommended )
• provider: Immich

4. Hit create

Final Steps

1. Head back to the provider
2. Copy the OpenID Configuration Issuer into notepad

Setup in immich

1. Go to Administration > Settings > Auth settings > OAuth
2. Paste/Put in the values

• ISSUER URL - paste the OpenID Configuration Issuer here
• CLIENT ID - paste the Client Id here
• CLIENT SECRET - paste the Client Secret here

3. Check if these options are correct

4. Save the config

Gitea

Using Authentik

Provider

1. Go to Applications > Providers
2. Create a new provider
3. Choose OAuth2/OpenID Provider

• Name: Gitea
• Authentication flow: default-authentication-flow
• Authorization flow: default-provider-authorization-explicit-consent

4. Copy the Client Id and Client Secret into notepad
5. Create the provider

Application

1. Go to Applications > Applications
2. Create a new Application
3. Use these options
   name: Gitea
   slug: git ( Recommended )
   provider: Gitea
4. Hit create

Final Steps

1. Head back to the provider
2. Copy the OpenID Configuration URL into notepad

Using Github

1. Head to Settings > Developer Options > OAuth Apps
2. Clock on New OAuth App
3. Put in these values

• Application Name: Gitea
• Homepage Url: YOUR_GITEA_URL_INSTANCE
• Application Description: Login to (URL_HERE) using github
• Authorization callback url> URL_HERE/user/oauth2/Github/callback

4. Register the Application
5. Generate a new Client Secret
6. Copy the Client Id and CLient Secret

Setup in Gitea

1. Go to Sitea Administration > Identity & Access > Authentication Sources
2. Click on Add Authentication Source

For Authentik

Paste/Put in the values

• Authentication Name: Authentik
• Authentication Type: OAuth2
• OAuth2 Provider: OpenID Connect
• Client Id > PASTE_THE_CLIENT_ID_YOU_SAVED
• Client Secret > PASTE_THE_CLIENT_SECRET_YOU_SAVED
• OpenID Connect Auto Discovery URL > PASTE_THE_OPENID_CONFIGURATION_URL_YOU_SAVED
• Additional Scopes: email profile
• ( Optional ) Icon url: https://authentik.yourdomain.com/static/dist/assets/icons/icon.svg

Create the Source once finished

For Github

Paste/Put in the values

• Authentication Name: Github
• Authentication Type: OAuth2
• OAuth2 Provider: Github
• Client Id > PASTE_THE_CLIENT_ID_YOU_SAVED
• Client Secret > PASTE_THE_CLIENT_SECRET_YOU_SAVED
• ( Optional ) Icon URL: https://github.githubassets.com/images/modules/logos_page/GitHub-Mark.png
  Create the Source once finished