Immich OICD Auth issue

sepidre commented

2026-01-25 08:32:37 -06:00

(Migrated from github.com)

Hi there

I want to secure my immich but get this issuer below.

Describe the bug:

I want to auhenticate Immich with voidauth but I get allways this error in Immich:

2026-01-25T14:14:54.993769508Z [Nest] 22 2026-01-25T14:14:54.993962604Z [Nest] 22 2026-01-25T14:14:54.993979336Z 2026-01-25T14:14:54.993983293Z 2026-01-25T14:14:54.993985958Z 2026-01-25T14:14:54.993989015Z 2026-01-25T14:14:54.993991780Z 2026-01-25T14:14:54.993994215Z 2026-01-25T14:14:54.993996609Z 2026-01-25T14:14:54.993999064Z 2026-01-25T14:14:54.994001418Z 2026-01-25T14:14:54.994003752Z 2026-01-25T14:14:54.994006197Z 2026-01-25T14:14:54.994008481Z 2026-01-25T14:14:54.994020825Z 2026-01-25T14:14:54.994022928Z }
2026-01-25T14:14:54.994024882Z }
2026-01-25T14:14:54.994100004Z [Nest] 22 2026-01-25T14:14:54.994106717Z 2026-01-25T14:14:54.994109352Z 2026-01-25T14:14:54.994111807Z 2026-01-25T14:14:54.994113820Z 2026-01-25T14:14:54.994116125Z - 01/25/2026, 3:14:54 PM ERROR [Api:OAuthRepositorysz83z3zc] OAuth login failed: fetch failed
- 01/25/2026, 3:14:54 PM ERROR [Api:OAuthRepositorysz83z3zc] TypeError: fetch failed
at node:internal/deps/undici/undici:13510:13
at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
at async tokenEndpointRequest (file:///usr/src/app/server/node_modules/.pnpm/oauth4webapi@3.8.3/node_modules/oauth4webapi/build/index.js:1169:22)
at async authorizationCodeGrant (file:///usr/src/app/server/node_modules/.pnpm/openid-client@6.8.1/node_modules/openid-client/build/index.js:958:22)
at async OAuthRepository.getProfile (/usr/src/app/server/dist/repositories/oauth.repository.js:56:28)
at async AuthService.callback (/usr/src/app/server/dist/services/auth.service.js:188:25)
at async OAuthController.finishOAuth (/usr/src/app/server/dist/controllers/oauth.controller.js:47:22) {
[cause]: ConnectTimeoutError: Connect Timeout Error (attempted address: voidauth.myDomain.com:80, timeout: 10000ms)
at onConnectTimeout (node:internal/deps/undici/undici:2602:28)
at Immediate._onImmediate (node:internal/deps/undici/undici:2583:11)
at process.processImmediate (node:internal/timers:485:21)
at process.callbackTrampoline (node:internal/async_hooks:130:17) {
code: 'UND_ERR_CONNECT_TIMEOUT'
- 01/25/2026, 3:14:54 PM ERROR [Api:ErrorInterceptor~sz83z3zc] Unknown error: Error: OAuth login failed
Error: OAuth login failed
at OAuthRepository.getProfile (/usr/src/app/server/dist/repositories/oauth.repository.js:72:19)
at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
at async AuthService.callback (/usr/src/app/server/dist/services/auth.service.js:188:25)
at async OAuthController.finishOAuth (/usr/src/app/server/dist/controllers/oauth.controller.js:47:22)

I have Portainer successfully configured with oauth and immich/portainer and voidauth are within the same reverseproxy and docker swarm environment.

I tried also the Auth Methods post/basic and none.

The Immich traedfik swarm compose label are

traefik.enable: 1
traefik.swarm.network: cloud-public
## HTTP Routers
traefik.http.routers.immich.entrypoints: web
traefik.http.routers.immich.rule: Host(`immich.mydomain.com`)
## Middlewares
traefik.http.routers.immich.middlewares: voidauth-middle@swarm
## HTTP Services
traefik.http.routers.immich.service: immich
traefik.http.services.immich.loadbalancer.server.port: 2283

The portainer traedfik swarm compose label are

traefik.enable: 1
traefik.swarm.network: cloud-public
# define traefik dashboard router and service
traefik.http.routers.portainer.rule: Host(`portainer.mydomain.com`)
traefik.http.routers.portainer.service: portainer-svc
traefik.http.routers.portainer.entrypoints: web
traefik.http.routers.portainer.middlewares: chain-no-auth@file
traefik.http.services.portainer-svc.loadbalancer.server.port: 9000
traefik.http.services.portainer-svc.loadbalancer.passhostheader: 1

The main difference is the middleware?

Screenshots:

Voidauth Config

Immich Confg

Hi there I want to secure my immich but get this issuer below. ### Describe the bug: I want to auhenticate Immich with voidauth but I get allways this error in Immich: > 2026-01-25T14:14:54.993769508Z [Nest] 22 - 01/25/2026, 3:14:54 PM ERROR [Api:OAuthRepository~sz83z3zc] OAuth login failed: fetch failed > 2026-01-25T14:14:54.993962604Z [Nest] 22 - 01/25/2026, 3:14:54 PM ERROR [Api:OAuthRepository~sz83z3zc] TypeError: fetch failed > 2026-01-25T14:14:54.993979336Z at node:internal/deps/undici/undici:13510:13 > 2026-01-25T14:14:54.993983293Z at process.processTicksAndRejections (node:internal/process/task_queues:105:5) > 2026-01-25T14:14:54.993985958Z at async tokenEndpointRequest (file:///usr/src/app/server/node_modules/.pnpm/oauth4webapi@3.8.3/node_modules/oauth4webapi/build/index.js:1169:22) > 2026-01-25T14:14:54.993989015Z at async authorizationCodeGrant (file:///usr/src/app/server/node_modules/.pnpm/openid-client@6.8.1/node_modules/openid-client/build/index.js:958:22) > 2026-01-25T14:14:54.993991780Z at async OAuthRepository.getProfile (/usr/src/app/server/dist/repositories/oauth.repository.js:56:28) > 2026-01-25T14:14:54.993994215Z at async AuthService.callback (/usr/src/app/server/dist/services/auth.service.js:188:25) > 2026-01-25T14:14:54.993996609Z at async OAuthController.finishOAuth (/usr/src/app/server/dist/controllers/oauth.controller.js:47:22) { > 2026-01-25T14:14:54.993999064Z [cause]: ConnectTimeoutError: Connect Timeout Error (attempted address: voidauth.myDomain.com:80, timeout: 10000ms) > 2026-01-25T14:14:54.994001418Z at onConnectTimeout (node:internal/deps/undici/undici:2602:28) > 2026-01-25T14:14:54.994003752Z at Immediate._onImmediate (node:internal/deps/undici/undici:2583:11) > 2026-01-25T14:14:54.994006197Z at process.processImmediate (node:internal/timers:485:21) > 2026-01-25T14:14:54.994008481Z at process.callbackTrampoline (node:internal/async_hooks:130:17) { > 2026-01-25T14:14:54.994020825Z code: 'UND_ERR_CONNECT_TIMEOUT' > 2026-01-25T14:14:54.994022928Z } > 2026-01-25T14:14:54.994024882Z } > 2026-01-25T14:14:54.994100004Z [Nest] 22 - 01/25/2026, 3:14:54 PM ERROR [Api:ErrorInterceptor~sz83z3zc] Unknown error: Error: OAuth login failed > 2026-01-25T14:14:54.994106717Z Error: OAuth login failed > 2026-01-25T14:14:54.994109352Z at OAuthRepository.getProfile (/usr/src/app/server/dist/repositories/oauth.repository.js:72:19) > 2026-01-25T14:14:54.994111807Z at process.processTicksAndRejections (node:internal/process/task_queues:105:5) > 2026-01-25T14:14:54.994113820Z at async AuthService.callback (/usr/src/app/server/dist/services/auth.service.js:188:25) > 2026-01-25T14:14:54.994116125Z at async OAuthController.finishOAuth (/usr/src/app/server/dist/controllers/oauth.controller.js:47:22) I have Portainer successfully configured with oauth and immich/portainer and voidauth are within the same reverseproxy and docker swarm environment. I tried also the Auth Methods post/basic and none. The Immich traedfik swarm compose label are ``` traefik.enable: 1 traefik.swarm.network: cloud-public ## HTTP Routers traefik.http.routers.immich.entrypoints: web traefik.http.routers.immich.rule: Host(`immich.mydomain.com`) ## Middlewares traefik.http.routers.immich.middlewares: voidauth-middle@swarm ## HTTP Services traefik.http.routers.immich.service: immich traefik.http.services.immich.loadbalancer.server.port: 2283 ``` The portainer traedfik swarm compose label are ``` traefik.enable: 1 traefik.swarm.network: cloud-public # define traefik dashboard router and service traefik.http.routers.portainer.rule: Host(`portainer.mydomain.com`) traefik.http.routers.portainer.service: portainer-svc traefik.http.routers.portainer.entrypoints: web traefik.http.routers.portainer.middlewares: chain-no-auth@file traefik.http.services.portainer-svc.loadbalancer.server.port: 9000 traefik.http.services.portainer-svc.loadbalancer.passhostheader: 1 ``` The main difference is the middleware? ### Screenshots: Voidauth Config <img width="1570" height="3660" alt="Image" src="https://github.com/user-attachments/assets/51e442d5-f135-4203-b838-1b86acdf7930" /> Immich Confg <img width="1762" height="4070" alt="Image" src="https://github.com/user-attachments/assets/9eb659df-6897-4595-a496-80864018d7f4" />

sepidre commented

2026-01-25 08:50:51 -06:00

(Migrated from github.com)

I tried it now also with the docker compose labels:

traefik.http.routers.immich.middlewares: chain-no-auth@file
traefik.http.services.immich.loadbalancer.passhostheader: 1

Same issue

I tried it now also with the docker compose labels: ``` traefik.http.routers.immich.middlewares: chain-no-auth@file traefik.http.services.immich.loadbalancer.passhostheader: 1 ``` Same issue

notquitenothing commented

2026-01-25 09:20:20 -06:00

(Migrated from github.com)

Interesting, I see in the Immich error message that there is a connection timeout when Immich tries to use the token endpoint (I assume after a successful login/redirect from VoidAuth). I also see that the url in the error is like voidauth.myDomain.com:80 (sanitized?) which I think should just be the token endpoint url of VoidAuth but I don’t know how that is getting set. At the very least I think it should be over https (so port 443). Unfortunately I don’t see anything immediately in your VoidAuth or Immich configs that looks wrong.

The proxy stuff shouldn’t matter I don’t think, OIDC endpoints are public URLs otherwise users wouldn’t be able to sign in, and apps should just use those same endpoints to get user tokens and info. I guess you could try and see if you can reach the public VoidAuth URL from within the Immich container, if not then that would be a problem.

Interesting, I see in the Immich error message that there is a connection timeout when Immich tries to use the token endpoint (I assume after a successful login/redirect from VoidAuth). I also see that the url in the error is like `voidauth.myDomain.com:80` (sanitized?) which I think should just be the token endpoint url of VoidAuth but I don’t know how that is getting set. At the very least I think it should be over https (so port 443). Unfortunately I don’t see anything immediately in your VoidAuth or Immich configs that looks wrong. The proxy stuff shouldn’t matter I don’t think, OIDC endpoints are public URLs otherwise users wouldn’t be able to sign in, and apps should just use those same endpoints to get user tokens and info. I guess you could try and see if you can reach the public VoidAuth URL from within the Immich container, if not then that would be a problem.

sepidre commented

2026-01-25 09:56:35 -06:00

(Migrated from github.com)

I saw that timeout as well an tried the :80 forcefully set to :443 (yes it is sanitized) within the immich config - same error. I tried it with skip consent and got forwarded to voidauth and after giving the consent I do not get redirected to immich, somehow like the this other reported error.
Also I am not so sure that this is the error, earlier I have the error "OAuth login failed: fetch failed" in the fist two lines.

I saw that timeout as well an tried the :80 forcefully set to :443 (yes it is sanitized) within the immich config - same error. I tried it with skip consent and got forwarded to voidauth and after giving the consent I do not get redirected to immich, somehow like the this other reported [error](https://github.com/voidauth/voidauth/issues/282#issuecomment-3796835214). Also I am not so sure that this is the error, earlier I have the error "OAuth login failed: fetch failed" in the fist two lines.

notquitenothing commented

2026-01-25 10:42:13 -06:00

(Migrated from github.com)

True. Just to clarify, you are getting redirected to VoidAuth to perform a login and once successful, you are not being sent back to Immich or you are but Immich is giving an error when you get back?

sepidre commented

2026-01-25 14:56:22 -06:00

(Migrated from github.com)

I saw that timeout as well an tried the :80 forcefully set to :443 (yes it is sanitized) within the immich config - same error. I tried it with skip consent and got forwarded to voidauth and after giving the consent I do not get redirected to immich, somehow like the
Also I am not so sure that this is the error, earlier I have the error "OAuth login failed: fetch failed" in the fist two lines.

I saw that timeout as well an tried the :80 forcefully set to :443 (yes it is sanitized) within the immich config - same error. I tried it with skip consent and got forwarded to voidauth and after giving the consent I do not get redirected to immich, somehow like the Also I am not so sure that this is the error, earlier I have the error "OAuth login failed: fetch failed" in the fist two lines.

sepidre commented

2026-01-25 14:59:35 -06:00

(Migrated from github.com)

This is the Immich error screen

And here the log:

2026-01-25T20:56:34.559265225Z user found in getUserSessionInteraction; source = session
2026-01-25T20:56:34.564568464Z interaction required: {"prompt":"consent","reasons":["native_client_prompt","op_scopes_missing"],"client_id":"immich","username":"sepidre","proxyauth":false}
2026-01-25T20:57:24.211200996Z user found in getUserSessionInteraction; source = session
2026-01-25T20:57:24.216738750Z user found in getUserSessionInteraction; source = session
2026-01-25T20:57:24.217296096Z user found in getUserSessionInteraction; source = session
2026-01-25T20:57:24.220335466Z user found in getUserSessionInteraction; source = session
2026-01-25T20:57:24.221407988Z proxyauth access granted to domain: .mydomain.com
2026-01-25T20:57:24.222503884Z proxyauth access granted to domain: .mydomain.com/
2026-01-25T20:57:24.224079631Z proxyauth access granted to domain: .mydomain.com/
2026-01-25T20:57:24.224445134Z proxyauth access granted to domain: .mydomain.com/
2026-01-25T20:57:24.231945648Z user found in getUserSessionInteraction; source = session
2026-01-25T20:57:24.232717300Z user found in getUserSessionInteraction; source = session
2026-01-25T20:57:24.233207829Z proxyauth access granted to domain: .mydomain.com/
2026-01-25T20:57:24.234111591Z user found in getUserSessionInteraction; source = session
2026-01-25T20:57:24.234745914Z proxyauth access granted to domain: .mydomain.com/
2026-01-25T20:57:24.235076049Z proxyauth access granted to domain: .mydomain.com/
2026-01-25T20:57:24.236471534Z user found in getUserSessionInteraction; source = session
2026-01-25T20:57:24.237563914Z proxyauth access granted to domain: .mydomain.com/
2026-01-25T20:57:24.455156445Z user found in getUserSessionInteraction; source = session
2026-01-25T20:57:24.456148985Z proxyauth access granted to domain: .mydomain.com/
2026-01-25T20:57:24.460440768Z user found in getUserSessionInteraction; source = session
2026-01-25T20:57:24.461350442Z proxyauth access granted to domain: .mydomain.com/
2026-01-25T20:57:24.471500697Z user found in getUserSessionInteraction; source = session
2026-01-25T20:57:24.472426402Z proxyauth access granted to domain: .mydomain.com/
2026-01-25T20:57:24.475984344Z user found in getUserSessionInteraction; source = session
2026-01-25T20:57:24.476709017Z proxyauth access granted to domain: .mydomain.com
2026-01-25T20:57:27.486333422Z user found in getUserSessionInteraction; source = session
2026-01-25T20:57:27.487089694Z proxyauth access granted to domain: .mydomain.com/

This is the Immich error screen <img width="1184" height="1444" alt="Image" src="https://github.com/user-attachments/assets/b2a482bd-e377-47da-88a5-05dc3706ad3e" /> And here the log: > 2026-01-25T20:56:34.559265225Z user found in getUserSessionInteraction; source = session > 2026-01-25T20:56:34.564568464Z interaction required: {"prompt":"consent","reasons":["native_client_prompt","op_scopes_missing"],"client_id":"immich","username":"sepidre","proxyauth":false} > 2026-01-25T20:57:24.211200996Z user found in getUserSessionInteraction; source = session > 2026-01-25T20:57:24.216738750Z user found in getUserSessionInteraction; source = session > 2026-01-25T20:57:24.217296096Z user found in getUserSessionInteraction; source = session > 2026-01-25T20:57:24.220335466Z user found in getUserSessionInteraction; source = session > 2026-01-25T20:57:24.221407988Z proxyauth access granted to domain: *.mydomain.com* > 2026-01-25T20:57:24.222503884Z proxyauth access granted to domain: *.mydomain.com/* > 2026-01-25T20:57:24.224079631Z proxyauth access granted to domain: *.mydomain.com/* > 2026-01-25T20:57:24.224445134Z proxyauth access granted to domain: *.mydomain.com/* > 2026-01-25T20:57:24.231945648Z user found in getUserSessionInteraction; source = session > 2026-01-25T20:57:24.232717300Z user found in getUserSessionInteraction; source = session > 2026-01-25T20:57:24.233207829Z proxyauth access granted to domain: *.mydomain.com/* > 2026-01-25T20:57:24.234111591Z user found in getUserSessionInteraction; source = session > 2026-01-25T20:57:24.234745914Z proxyauth access granted to domain: *.mydomain.com/* > 2026-01-25T20:57:24.235076049Z proxyauth access granted to domain: *.mydomain.com/* > 2026-01-25T20:57:24.236471534Z user found in getUserSessionInteraction; source = session > 2026-01-25T20:57:24.237563914Z proxyauth access granted to domain: *.mydomain.com/* > 2026-01-25T20:57:24.455156445Z user found in getUserSessionInteraction; source = session > 2026-01-25T20:57:24.456148985Z proxyauth access granted to domain: *.mydomain.com/* > 2026-01-25T20:57:24.460440768Z user found in getUserSessionInteraction; source = session > 2026-01-25T20:57:24.461350442Z proxyauth access granted to domain: *.mydomain.com/* > 2026-01-25T20:57:24.471500697Z user found in getUserSessionInteraction; source = session > 2026-01-25T20:57:24.472426402Z proxyauth access granted to domain: *.mydomain.com/* > 2026-01-25T20:57:24.475984344Z user found in getUserSessionInteraction; source = session > 2026-01-25T20:57:24.476709017Z proxyauth access granted to domain: *.mydomain.com* > 2026-01-25T20:57:27.486333422Z user found in getUserSessionInteraction; source = session > 2026-01-25T20:57:27.487089694Z proxyauth access granted to domain: *.mydomain.com/*

mv-fs commented

2026-05-18 11:55:27 -05:00

(Migrated from github.com)

I have just setup a similar stack Immich (stack from Portainer) and VoidAuth (standalone container) both proxied through Nginx Proxy Manager and have had no issues.
I got it working with the configuration on both VoidAuth and Immich looking exactly like how @sepidre has it in his screenshots except for one difference -> for the Immich ISSUER_URL I did not use the full Well-Known Endpoint but only the OIDC Endpoint. The Immich docs say that the well-known path is not necessary and gets appended. Maybe you can try changing that.

Otherwise that would point at a Traefik / middleware misconfiguration

I have just setup a similar stack Immich (stack from Portainer) and VoidAuth (standalone container) both proxied through Nginx Proxy Manager and have had no issues. I got it working with the configuration on both VoidAuth and Immich looking exactly like how @sepidre has it in his screenshots except for one difference -> for the Immich **ISSUER_URL** I did not use the full _Well-Known Endpoint_ but only the _OIDC Endpoint_. The [Immich docs ](https://docs.immich.app/administration/oauth#enable-oauth) say that the well-known path is not necessary and gets appended. Maybe you can try changing that. Otherwise that would point at a Traefik / middleware misconfiguration

Rows
Columns

Immich OICD Auth issue #287

Describe the bug:

Screenshots: