* fix(server): re-evaluate OIDC role claim on every login and support array values
Previously the OIDC role claim (immich_role) was only read at user
auto-registration time and only accepted as a scalar string, so admin
status never updated after the first login and array-valued role/group
claims (common with Keycloak, Entra ID, etc.) were silently ignored.
Now the role claim is normalized from either a string or an array of
strings, and existing users have their isAdmin flag synced from the
claim on every login, keeping the IdP as the source of truth for
privileges while leaving isAdmin untouched when the claim is blank.
* fix(server): use .includes() instead of .some() for role claim check
Satisfies unicorn/prefer-includes lint rule flagged by CI.
* fix(server): resolve missing role claim to standard user and fix test mock
Default the OIDC role claim to 'user' when the IdP omits it so
auto-registration doesn't crash, and add the missing getAdmin mock in the
auth.service test so it correctly simulates an existing admin rather than
the first-user-registration path.
* fix: claim sync logic
---------
Co-authored-by: Jason Rasmussen <jrasm91@gmail.com>
* feat(server): add OIDC logout URL override option
- Added toggle and field consistent with existing mobile redirect URI override.
- Existing auto-discovery remains default.
- Update tests and docs for new feature.
* fix(server): changes from review for OIDC logout URL override
- Rename 'logoutUri' to 'endSessionEndpoint'
- Remove toggle, just use override if provided
- Moved field in settings UI
* feat(server): add configurable OAuth prompt parameter
Add a `prompt` field to the OAuth system config, allowing admins to
configure the OIDC `prompt` parameter (e.g. `select_account`, `login`,
`consent`). Defaults to empty string (no prompt sent), preserving
backward compatibility.
This is useful for providers like Google where users want to be prompted
to select an account when multiple accounts are signed in.
Discussed in #20762
* chore: regenerate OpenAPI spec and clients for OAuth prompt field
* Adding e2e test cases
* feat: web setting
* feat: docs
---------
Co-authored-by: Jason Rasmussen <jason@rasm.me>
* fix(oauth): normalize email claim to lowercase before account lookup and registration
* test(auth): add test for OAuth email case normalization
* chore: clean up
---------
Co-authored-by: Jason Rasmussen <jason@rasm.me>
* wip
* added user metadata key
* wip
* restructure onboarding system and add initial locale
* update language card and fix translation updating
* remove prints
* new card formattings
* fix cursed unmount effect
* add OAuth route onboarding
* remove required admin auth for onboarding
* delete the hotwire button
* update open-api files
* delete import
* fix failing oauth onboarding fields
* fix e2e test
* fix web e2e test
* add onboarding to user registration e2e test
* remove todo
this was a holdover during dev and didn't get deleted
* fix server small tests
* use onDestroy to save settings rather than a bind:this
* change to false for isOnboarded
* fix other auth small test
* provide type annotation in user factory metadata field
* remove onboardingCompelted from UserDto
* move translations to onboarding steps array and mark as derived so they update
* break language selector out into its own component as per @danieldietzler suggestion
* remove hello header on card
* fix flixkering on server privacy card
* label/id fixes
* openapi
---------
Co-authored-by: Alex Tran <alex.tran1502@gmail.com>
* fix: ensure oauth state param matches before finishing oauth flow
Signed-off-by: Tin Pecirep <tin.pecirep@gmail.com>
* chore: upgrade openid-client to v6
Signed-off-by: Tin Pecirep <tin.pecirep@gmail.com>
* feat: use PKCE for oauth2 on supported clients
Signed-off-by: Tin Pecirep <tin.pecirep@gmail.com>
* feat: use state and PKCE in mobile app
Signed-off-by: Tin Pecirep <tin.pecirep@gmail.com>
* fix: remove obsolete oauth repository init
Signed-off-by: Tin Pecirep <tin.pecirep@gmail.com>
* fix: rewrite callback url if mobile redirect url is enabled
Signed-off-by: Tin Pecirep <tin.pecirep@gmail.com>
* fix: propagate oidc client error cause when oauth callback fails
Signed-off-by: Tin Pecirep <tin.pecirep@gmail.com>
* fix: adapt auth service tests to required state and PKCE params
Signed-off-by: Tin Pecirep <tin.pecirep@gmail.com>
* fix: update sdk types
Signed-off-by: Tin Pecirep <tin.pecirep@gmail.com>
* fix: adapt oauth e2e test to work with PKCE
Signed-off-by: Tin Pecirep <tin.pecirep@gmail.com>
* fix: allow insecure (http) oauth clients
Signed-off-by: Tin Pecirep <tin.pecirep@gmail.com>
---------
Signed-off-by: Tin Pecirep <tin.pecirep@gmail.com>
Co-authored-by: Jason Rasmussen <jason@rasm.me>
* feat: sync pictureFile with oidc if it isn't set already
fix: move picture writer to get userId
fix: move await promise to the top of the setPicure function before checking its value and automatically create the user folder
chore: code cleanup
* fix: extension double dot
---------
Co-authored-by: Jason Rasmussen <jason@rasm.me>
Daniel Dietzler