Using Immich with Godoxy and Authentik #60

New Issue

adam · 2025-12-29T14:23:35+01:00

adam commented

2025-12-29 14:23:35 +01:00

Originally created by @reddwarf666 on GitHub (Apr 21, 2025).

I installed Immich today and have a question on how to setup Immich to work with Godoxy and Authentik.
Godoxy is configured with OIDC towards Authentik.

The goal is:

Use Immich with a browser, handled by Godoxy. I.e. be able to navigate to https://immich.example.com
Not have to login to Immich by means of OIDC/OAuth
Be able to use the Immich app on IOS

The browser part is working, I can navigate to https://immich.example.com, Authentik asks for my cedentials and I am then on the start page of Immich where it asks for my credentials. So this is point 1 covered I think.

Point 2 is where I would like the login page to not show, or have OAuth at least.
I read the OIDC/OAuth part of the Immich documentation and this got me an error : "Failed to finish oauth"
For the Immich part I read OAuth Authentication of it to set the config.
I was wondering though if the OIDC settings as done in Godoxy could be an issue?
I also saw this in the logs of Immich

[Nest] 26  - 04/21/2025, 12:01:55 PM   ERROR [Api:ErrorInterceptor~znhk2v7k] Unknown error: RPError: failed to decode JWT (TypeError: encrypted JWTs cannot be decoded)
RPError: failed to decode JWT (TypeError: encrypted JWTs cannot be decoded)
    at Client.validateJWT (/usr/src/app/node_modules/openid-client/lib/client.js:931:13)
    at Client.validateIdToken (/usr/src/app/node_modules/openid-client/lib/client.js:793:60)
    at Client.callback (/usr/src/app/node_modules/openid-client/lib/client.js:532:18)
    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
    at async OAuthRepository.getProfile (/usr/src/app/dist/repositories/oauth.repository.js:42:28)
    at async AuthService.callback (/usr/src/app/dist/services/auth.service.js:133:25)
    at async OAuthController.finishOAuth (/usr/src/app/dist/controllers/oauth.controller.js:39:22)

So not sure if this is related to Godoxy or Authentik or Immich.

For point 3 I wonder if I need to bypass Godoxy as the levels of authentication might hinder contacting Immich from the mobile app?

The docker-compose file for Immich has these labels:

labels:
  proxy.aliases: immich
  proxy.immich.port: 2283
  proxy.immich.scheme: http
  proxy.immich.middlewares.oidc: |
    allowed_users: [steven]
    allowed_groups: [everyone]

NB: should I still have the labels for middlewares in this? Could this be conflicting with the setup in of Immich and Authentik?

Godoxy OIDC config looks like this:

GODOXY_OIDC_ISSUER_URL=https://auth.example.com/application/o/godoxy/
GODOXY_OIDC_CLIENT_ID=<id>
GODOXY_OIDC_CLIENT_SECRET=<secret>
GODOXY_OIDC_REDIRECT_URL=https://godoxy.example.com/api/auth/callback
GODOXY_OIDC_SCOPES=openid, profile, email

I realize this might not at all be related to Godoxy but I wanted to check if my thoughts and settings are in line for making this work when I have Godoxy, Authentik and Immich. Or perhaps there is someone who made this work in a comparable setup?

Cheers

Originally created by @reddwarf666 on GitHub (Apr 21, 2025). I installed Immich today and have a question on how to setup Immich to work with Godoxy and Authentik. Godoxy is configured with OIDC towards Authentik. The goal is: 1. Use Immich with a browser, handled by Godoxy. I.e. be able to navigate to `https://immich.example.com` 2. Not have to login to Immich by means of OIDC/OAuth 3. Be able to use the Immich app on IOS The browser part is working, I can navigate to `https://immich.example.com`, Authentik asks for my cedentials and I am then on the start page of Immich where it asks for my credentials. So this is point 1 covered I think. Point 2 is where I would like the login page to not show, or have OAuth at least. I read the OIDC/OAuth part of the Immich documentation and this got me an error : "Failed to finish oauth" For the Immich part I read [OAuth Authentication](https://immich.app/docs/administration/oauth/) of it to set the config. I was wondering though if the OIDC settings as done in Godoxy could be an issue? I also saw this in the logs of Immich ``` [Nest] 26 - 04/21/2025, 12:01:55 PM ERROR [Api:ErrorInterceptor~znhk2v7k] Unknown error: RPError: failed to decode JWT (TypeError: encrypted JWTs cannot be decoded) RPError: failed to decode JWT (TypeError: encrypted JWTs cannot be decoded) at Client.validateJWT (/usr/src/app/node_modules/openid-client/lib/client.js:931:13) at Client.validateIdToken (/usr/src/app/node_modules/openid-client/lib/client.js:793:60) at Client.callback (/usr/src/app/node_modules/openid-client/lib/client.js:532:18) at process.processTicksAndRejections (node:internal/process/task_queues:105:5) at async OAuthRepository.getProfile (/usr/src/app/dist/repositories/oauth.repository.js:42:28) at async AuthService.callback (/usr/src/app/dist/services/auth.service.js:133:25) at async OAuthController.finishOAuth (/usr/src/app/dist/controllers/oauth.controller.js:39:22) ``` So not sure if this is related to Godoxy or Authentik or Immich. For point 3 I wonder if I need to bypass Godoxy as the levels of authentication might hinder contacting Immich from the mobile app? The docker-compose file for Immich has these labels: ``` labels: proxy.aliases: immich proxy.immich.port: 2283 proxy.immich.scheme: http proxy.immich.middlewares.oidc: | allowed_users: [steven] allowed_groups: [everyone] ``` NB: should I still have the labels for middlewares in this? Could this be conflicting with the setup in of Immich and Authentik? Godoxy OIDC config looks like this: ``` GODOXY_OIDC_ISSUER_URL=https://auth.example.com/application/o/godoxy/ GODOXY_OIDC_CLIENT_ID=<id> GODOXY_OIDC_CLIENT_SECRET=<secret> GODOXY_OIDC_REDIRECT_URL=https://godoxy.example.com/api/auth/callback GODOXY_OIDC_SCOPES=openid, profile, email ``` I realize this might not at all be related to Godoxy but I wanted to check if my thoughts and settings are in line for making this work when I have Godoxy, Authentik and Immich. Or perhaps there is someone who made this work in a comparable setup? Cheers

adam closed this issue

2025-12-29 14:23:36 +01:00

adam commented

2025-12-29 14:23:37 +01:00

@yusing commented on GitHub (Apr 21, 2025):

For apps that support OIDC natively, do not use the OIDC middleware but set up inside the app instead.

@yusing commented on GitHub (Apr 21, 2025): ![Image](https://github.com/user-attachments/assets/574d3f83-1659-4587-b397-6059695738a3) For apps that support OIDC natively, do not use the OIDC middleware but set up inside the app instead.

adam commented

2025-12-29 14:23:37 +01:00

@reddwarf666 commented on GitHub (Apr 21, 2025):

I thought it had to be something like that!
Changed the labels and took away middlewares.oidc ones.
Restarted the container (down & up) and tried and still got the "Failed to finish oauth" in combination with that jwks error in the Immich log.

I will check on the Immich site and ask for help over there.
Just to be sure, does Godoxy send the headers as Immich/Authentik expects do you think? I read that the reverse proxy needs to forward all headers:
Immich Reverse Proxy
Just wanted to double check as this will probably come up when I ask for help with this on the Immich side of things.

Cheers!

@reddwarf666 commented on GitHub (Apr 21, 2025): I thought it had to be something like that! Changed the labels and took away middlewares.oidc ones. Restarted the container (down & up) and tried and still got the "Failed to finish oauth" in combination with that jwks error in the Immich log. I will check on the Immich site and ask for help over there. Just to be sure, does Godoxy send the headers as Immich/Authentik expects do you think? I read that the reverse proxy needs to forward all headers: [Immich Reverse Proxy](https://immich.app/docs/administration/reverse-proxy/) Just wanted to double check as this will probably come up when I ask for help with this on the Immich side of things. Cheers!

adam commented

2025-12-29 14:23:37 +01:00

@yusing commented on GitHub (Apr 21, 2025):

If you still got the error it means you have'nt configured immich oauth correctly. How GoDoxy handles header is similar to the others.

@yusing commented on GitHub (Apr 21, 2025): If you still got the error it means you have'nt configured immich oauth correctly. How GoDoxy handles header is similar to the others.

adam commented

2025-12-29 14:23:37 +01:00

@reddwarf666 commented on GitHub (Apr 21, 2025):

Ok, thanks!

@reddwarf666 commented on GitHub (Apr 21, 2025): Ok, thanks!

adam commented

2025-12-29 14:23:38 +01:00

@reddwarf666 commented on GitHub (Apr 21, 2025):

Update! This might help someone at some point in some timeline 😀

By some odd reason I had the setting "Encryption Key" set in my Authentik provider for Immich with "authentik Self-signed Certificate".

This caused the JWT error TypeError: encrypted JWTs cannot be decoded
Makes sense as the origin never encoded the JWT with that self signed authentik certificate and it was also not expected to be encoded.

Your "Signing Key" in Authentik should be set, but not the option "Encryption Key"

I will close this thread as it is a) resolved and b) had nothing to do with Godoxy

@reddwarf666 commented on GitHub (Apr 21, 2025): Update! This might help someone at some point in some timeline 😀 By some odd reason I had the setting "Encryption Key" set in my Authentik provider for Immich with "authentik Self-signed Certificate". This caused the JWT error `TypeError: encrypted JWTs cannot be decoded` Makes sense as the origin never encoded the JWT with that self signed authentik certificate and it was also not expected to _be_ encoded. Your "Signing Key" in Authentik should be set, but **_not_** the option "Encryption Key" I will close this thread as it is a) resolved and b) had nothing to do with Godoxy

adam referenced this issue

2025-12-29 14:25:43 +01:00

[PR #60] [MERGED] Feat/fileserver #154

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/godoxy-yusing#60