OpenID invalid_request #9538

gravelfreeman · 2024-05-16T20:38:00Z

gravelfreeman
May 16, 2024

@jrasm91 tagged per your request in [BUG] Failed to finish oauth #6400 discussion.

Currently writing a guide to setup up OpenID on Truecharts and would appreciate some help.

The guide on Authelia's website seems to be outdated and doesn't include any information about the Signing Algorithm that seems to be required in Immich since 1.95.1. I tried leaving the field empty or set none but then I'm getting the same error as in the other topic;

OPError: invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).)

I tried to setup RS256 but I'm always getting this error no matter what I'm trying;

[Nest] 8  - 05/16/2024, 12:34:34 PM   ERROR [ImmichServer] [OPError: invalid_request (The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. Clients must include a 'code_challenge' when performing the authorize code flow, but it is missing.)
    at Client.callback (/usr/src/app/node_modules/openid-client/lib/client.js:443:13)
    at AuthService.getOAuthProfile (/usr/src/app/dist/services/auth.service.js:221:41)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async AuthService.callback (/usr/src/app/dist/services/auth.service.js:154:25)
    at async OAuthController.finishOAuth (/usr/src/app/dist/controllers/oauth.controller.js:39:22)] OPError: invalid_request (The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. Clients must include a 'code_challenge' when performing the authorize code flow, but it is missing.)

Answered by Alexsaphir

May 17, 2024

Oh, I think you need to set the clear secret not the hashed one with argon generated as:

authelia crypto hash generate pbkdf2 --variant sha512 --random --random.length 72 --random.charset rfc3986

The clear one for immich, the one starting with $argon2id for authelia.

View full answer

jrasm91 · 2024-05-16T20:42:41Z

jrasm91
May 16, 2024
Maintainer

Can you share the configuration you are using in authelia for the immich provider?

0 replies

gravelfreeman · 2024-05-16T21:03:47Z

gravelfreeman
May 16, 2024
Author

Can you share the configuration you are using in authelia for the immich provider?

Sure! As I said I'm writing a guide for Truecharts which runs in TrueNAS Scale. All of the configuration must be passed through a gui, but there's quite a lot of options in there. I tried a lot of configurations so I'll share here the one that was advised in Authelia's documentation.

First I generated a secret in Authelia pod shell with this command and used the Digest string.

authelia crypto hash generate argon2 --random --random.length 64 --random.charset alphanumeric

Then in Authelia app configuration I've set those values.

ID/Name*
immich

Description*
Photos

Secret*
Pasted the string similar to this one;

$argon2id$v=19$m=65536,t=3,p=4$73vWxSVOsx7fyyBJkQhcRg$8REzvUlvZg4+3ALjfGVsxfucjJKI1MD7PnXduRYDm0I

Authorization Policy
two_factor

Consent Mode
auto

Userinfo Signing Algorithm
none but also tried RS256 but weren't able to get it to work

Audience
Left this empty

Scopes
openid
profile
email

redirect_uris
https://sub.domain.tld/auth/login
https://sub.domain.tld/user-settings
app.immich:/

grant_types
Left this empty

response_types
Left this empty

response_modes
Left this empty

token_endpoint_auth_method
client_secret_basic but other choices are; client_secret_post, client_secret_jwt, client_secret_jwt, private_key_jwt or none

** Require PKCE ** (checkbox)
Unchecked

PKCE Challange Method
Left this empty

Hope this helps and thank you for helping me out!

2 replies

jrasm91 May 17, 2024
Maintainer

Grant type should be authorization_code

gravelfreeman May 17, 2024
Author

Unfortunately that didn't work. Hope we can sort this out, thank you for helping!

Here's the error with Userinfo Signing Algorithm set to RS256;

[Nest] 8  - 05/17/2024, 12:55:25 AM   ERROR [ImmichServer] [OPError: invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).)
    at processResponse (/usr/src/app/node_modules/openid-client/lib/helpers/process_response.js:38:13)
    at Client.grant (/usr/src/app/node_modules/openid-client/lib/client.js:1354:22)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async Client.callback (/usr/src/app/node_modules/openid-client/lib/client.js:493:24)
    at async AuthService.getOAuthProfile (/usr/src/app/dist/services/auth.service.js:221:28)
    at async AuthService.callback (/usr/src/app/dist/services/auth.service.js:154:25)
    at async OAuthController.finishOAuth (/usr/src/app/dist/controllers/oauth.controller.js:39:22)] Failed to finish oauth
[Nest] 8  - 05/17/2024, 12:55:25 AM   ERROR [ImmichServer] [OPError: invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).)
    at processResponse (/usr/src/app/node_modules/openid-client/lib/helpers/process_response.js:38:13)
    at Client.grant (/usr/src/app/node_modules/openid-client/lib/client.js:1354:22)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async Client.callback (/usr/src/app/node_modules/openid-client/lib/client.js:493:24)
    at async AuthService.getOAuthProfile (/usr/src/app/dist/services/auth.service.js:221:28)
    at async AuthService.callback (/usr/src/app/dist/services/auth.service.js:154:25)
    at async OAuthController.finishOAuth (/usr/src/app/dist/controllers/oauth.controller.js:39:22)] OPError: invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).)

Here's the error with Userinfo Signing Algorithm set to none;

[Nest] 8  - 05/17/2024, 1:11:09 AM   ERROR [ImmichServer] [OPError: invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).)
    at processResponse (/usr/src/app/node_modules/openid-client/lib/helpers/process_response.js:38:13)
    at Client.grant (/usr/src/app/node_modules/openid-client/lib/client.js:1354:22)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async Client.callback (/usr/src/app/node_modules/openid-client/lib/client.js:493:24)
    at async AuthService.getOAuthProfile (/usr/src/app/dist/services/auth.service.js:221:28)
    at async AuthService.callback (/usr/src/app/dist/services/auth.service.js:154:25)
    at async OAuthController.finishOAuth (/usr/src/app/dist/controllers/oauth.controller.js:39:22)] Failed to finish oauth
[Nest] 8  - 05/17/2024, 1:11:09 AM   ERROR [ImmichServer] [OPError: invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).)
    at processResponse (/usr/src/app/node_modules/openid-client/lib/helpers/process_response.js:38:13)
    at Client.grant (/usr/src/app/node_modules/openid-client/lib/client.js:1354:22)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async Client.callback (/usr/src/app/node_modules/openid-client/lib/client.js:493:24)
    at async AuthService.getOAuthProfile (/usr/src/app/dist/services/auth.service.js:221:28)
    at async AuthService.callback (/usr/src/app/dist/services/auth.service.js:154:25)
    at async OAuthController.finishOAuth (/usr/src/app/dist/controllers/oauth.controller.js:39:22)] OPError: invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).)

Alexsaphir · 2024-05-16T23:21:31Z

Alexsaphir
May 16, 2024

Hey ! If you want, this is my actual Authelia configuration and I declare the immich config, immich-config.json, in the helm chart (app-template).

1 reply

gravelfreeman May 17, 2024
Author

Thank for replying, unfortunately I already tried a similar configuration and it's not working. What version of Immich are you on? Because I see you haven't bothered with RS256.

gravelfreeman · 2024-05-17T13:55:33Z

gravelfreeman
May 17, 2024
Author

I think I might have made a mistake setting up the actual settings in Immich itself.

I was wondering if I had to replace openid-configuration in ISSUER URL for an actual configuration url?

5 replies

Alexsaphir May 17, 2024

On my side, I don't have the .well-known...

gravelfreeman May 17, 2024
Author

It's not working unfortunately.

[Nest] 8  - 05/17/2024, 10:08:25 AM   ERROR [ImmichServer] [OPError: invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).)
    at processResponse (/usr/src/app/node_modules/openid-client/lib/helpers/process_response.js:38:13)
    at Client.grant (/usr/src/app/node_modules/openid-client/lib/client.js:1354:22)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async Client.callback (/usr/src/app/node_modules/openid-client/lib/client.js:493:24)
    at async AuthService.getOAuthProfile (/usr/src/app/dist/services/auth.service.js:221:28)
    at async AuthService.callback (/usr/src/app/dist/services/auth.service.js:154:25)
    at async OAuthController.finishOAuth (/usr/src/app/dist/controllers/oauth.controller.js:39:22)] Failed to finish oauth
[Nest] 8  - 05/17/2024, 10:08:25 AM   ERROR [ImmichServer] [OPError: invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).)
    at processResponse (/usr/src/app/node_modules/openid-client/lib/helpers/process_response.js:38:13)
    at Client.grant (/usr/src/app/node_modules/openid-client/lib/client.js:1354:22)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async Client.callback (/usr/src/app/node_modules/openid-client/lib/client.js:493:24)
    at async AuthService.getOAuthProfile (/usr/src/app/dist/services/auth.service.js:221:28)
    at async AuthService.callback (/usr/src/app/dist/services/auth.service.js:154:25)
    at async OAuthController.finishOAuth (/usr/src/app/dist/controllers/oauth.controller.js:39:22)] OPError: invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).)

What do you have in SIGNING ALGORITHM?

Alexsaphir May 17, 2024

Oh, I think you need to set the clear secret not the hashed one with argon generated as:

authelia crypto hash generate pbkdf2 --variant sha512 --random --random.length 72 --random.charset rfc3986

The clear one for immich, the one starting with $argon2id for authelia.

Answer selected by gravelfreeman

gravelfreeman May 17, 2024
Author

MY SAVIOR! Thank you so much. I literally spent the past 3 days trying to get this working. You probably found the issue I had for all of my other applications as well. Will have to test!

scetu Feb 9, 2025

Oh, I think you need to set the clear secret not the hashed one with argon generated as:
authelia crypto hash generate pbkdf2 --variant sha512 --random --random.length 72 --random.charset rfc3986
The clear one for immich, the one starting with $argon2id for authelia.

This needs to be highlighted on both sides of documentation, Authelia and Immich! Thank you!

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OpenID invalid_request #9538

{{title}}

Replies: 4 comments 8 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

OpenID invalid_request #9538

gravelfreeman May 16, 2024

Replies: 4 comments · 8 replies

jrasm91 May 16, 2024 Maintainer

gravelfreeman May 16, 2024 Author

jrasm91 May 17, 2024 Maintainer

gravelfreeman May 17, 2024 Author

Alexsaphir May 16, 2024

gravelfreeman May 17, 2024 Author

gravelfreeman May 17, 2024 Author

Alexsaphir May 17, 2024

gravelfreeman May 17, 2024 Author

Alexsaphir May 17, 2024

gravelfreeman May 17, 2024 Author

scetu Feb 9, 2025

gravelfreeman
May 16, 2024

Replies: 4 comments 8 replies

jrasm91
May 16, 2024
Maintainer

gravelfreeman
May 16, 2024
Author

jrasm91 May 17, 2024
Maintainer

gravelfreeman May 17, 2024
Author

Alexsaphir
May 16, 2024

gravelfreeman May 17, 2024
Author

gravelfreeman
May 17, 2024
Author

gravelfreeman May 17, 2024
Author

gravelfreeman May 17, 2024
Author