[Feature]: Oauth features

[Maypul]

Feature detail

Hi there,

it is great to see that Oauth has been implemented, I was wondering if following features are planned:

1. possibility to choose which User identifier to map
2. possibility to put each of oauth links separately instead of main one (authorization_endpoint, token_endpoint, userinfo_endpoint, jwks_uri)
3. allow access based on groups user has assigned from oauth provider

Platform

Web

[jrasm91]

What is the benefit or use case for 1 or 2?

3 had been discussed, and could be implemented in the future.

[Maypul]

1. not all my users in my oauth provider have an email, I'd assume that would be an issue? We use a preffered username instead of email for identification which is mandatory, unique field.
2. With specific setup it would allow to map direct links and now get the default one from well known file. This specific setup, I do have in one instance where we have a local DNS setup and server set up in a way, where if an app would get their config from well known file and the user authenticating in this specific location, it will not work for them. Possiblity to use separate links would allow us to use direct link to these configs would would be resolveable within this specific network, and would work for everyone. I'd say it is edge case, but we do use this setup in other apps (Portainer for example).

[jrasm91]

Ah, number one is related to auto registration I think? Email is required in immich at the moment and probably always, although with #1154 you could manually link the user (without an email) after creating the accounts in immich.

Number two does sounds like an edge case that could probably be solved with DNS, no? For simplicity we implemented it with one input instead of multiple. It is quite a bit simpler to display, validate, and store just the one, which does work for most people.

[Maypul]

Yes, it's related to autoregistration, I do not think that auto linking tons of users is good, hopefully we will be able to set user identifier :)

About 2, yes, it could be solveable with DNS but that ''core'' issue also comes from DNS setup. It's not feasible to solve it this way, but it is possible to route traffic around (in this case) to make it work. Would not a checkbox near the simple way saying advanced config be elegant and still simple? Checking it would expand options to fill in all separate values.

[jrasm91]

Email is a required field for a user in immich so what value would you use for that? Are you saying you want to put username from your system in the email field in immich? That won't work. So how would specifying a different attribute work? I think the issue is immich requires an email, but your system doesn't have one.

I'm not saying it's not possible. It just requires more work to build that. I can look into it though. A check box for "advanced" vs "automatic" could require all the endpoints instead of just one discovery url.

[TokugawaHeavyIndustries]

Looks like #1154 will completely solve 1

[jrasm91]

1 and 2 are not currently planned. 3 is possibly planned, but not until after #1043.

[bo0tzz]

#1633