[Feature]: User Groups for sharing/permissions

[Simpoltin]

Feature detail

I'd like be able to use groups of users. Either created by the admin, users, imported from oauth, or some combination thereof. Ideally the end result would be able to use all of those options together. Admin created through local and if they control the provider oauth information, with users being able to create their own local groups.

Reasoning behind this request is that all sides of my family have requested me to create a space for them to share photos with the family that isn't tied to some specific platform. Immich is far and above my top choice for this compared to other projects I have seen out there. Downside is that with my parents being divorced and then my wifes side of the family that's essentially three separate units. My mother doesn't want my father and his side of the family to see pictures of her birthday party for example. I don't want to run three instances of Immich because then photos I'd like all three family's to see need to be duplicated.

With user groups I could create a "Family A" group and share an event like "my mothers birthday party" album that was just pertinent to that side of the family without having to specify every member every time we create an album for an event. Same for "Family B" and "Family C". Then if there was some album I wanted to share with everyone, say my own birthday party I could share to all three groups or a group that contains those three nested.

The other advantage of groups vs individual sharing would be as new members of the family join the server and placed in their group they gain access to all albums shared to that family instead of having to go back and add their accounts to all existing albums.

This request in conjunction with nested albums requested in #1010 would create my perfect scenario for sharing and permissions. If #402 and #34 were implemented, Immich would become the only real choice in the photo hosting/backup realm in my humble opinion.

Platform

Server

[korotovsky]

I recently have implemented sort-of similar functionality as part of my earlier feature-request here #3781. I have not noticed this thread unfortunately. It does not bring full-featured groups but it can bring one family space via non interactive login account. So we don't need to rewrite whole immich to share facial data, geo data, albums and photos, etc.

It works in a way like non interactive login account has restricted abilities for interactive login (password/SAML is blocked) and you can assign other accounts to be logged into this account programmatically once you have performed an interactive login with password/SAML. As as result multiple users ends up into "shared" account where all photos belongs to the same user aka one family group. Audit log has been patched as well, you can also see you is actually using this. meta account.

Here are some screens from my unfinished PR

This might be not ideal, but amount of effort vs product outcome in my opinion is great:

This implementation gives us:

• One shared family space as an virtual account;
• Closes Sharing pictures with family #3886, [Feature] Impersonated / aliased / fully shared accounts #3781, Partially closes [Feature]: User Groups for sharing/permissions #1043, Closes "Save" images shared by others in my timeline. #3843 if belongs to the same family, Closes [Feature] Map markers for albums #3418 if belongs to the same family;
• Display shared photos in main photo feed;
• Facial data can be shared;
• Geo data can be shared;
• Edit/delete functionalities within "family" account;
• Does not touch core immich queries for selecting photos, etc because implemented as part of authentication layer.

P.S. I'm trying to fix some tests and finalize code I guess soon I will open a draft PR.

/cc @alextran1502

[alextran1502]

Hello, before putting more effort into the PR, do you mind open a focus-discussion post on Discord and ping all the Contributors for discussion?

[korotovsky]

Sure, let me join then

[flightmansam]

This is hella amazing and exactly what I have been looking for!!!

[YeapGuy]

Hi @korotovsky , how did this go? I'm really interested in this sort of functionality

[balthazar]

Hello @korotovsky and @alextran1502, I was wondering if there was any update on this PR/feature? I realized that manually geotagging shared pictures does not seem to properly work (although the call appears to be 2xx) and the image remains untagged upon refresh.

Not only this but considering the fact faces aren't shared between accounts, it appear only sharing a single account would solve the problem.

[traktuner]

I was about to open a similar feature request.
My plan: hosted immich instance, but users should not see all users on the hosted immich server. If there are people on the server who personally know each other (friends, family) then they see each other when they want to share an album. But they don't see "strangers".
The groups should be editable by the admin.
That would make it very easy to host immich for more users.

[chromosapiens]

I was about to write exactly this.
This is what holds me back to give out more accounts.

[fivestones]

I'm pretty interested in this too. Sometimes it's nice to be able to have just my own photos in my timeline, but I'd also like the option to view any photos shared with me in my timeline. And if there are recognized faces in either my photos or photos shared with me, they should all show up when I click on a face. There should be the option for my photos and photos shared with me to be able to show up together on the map, and searching for files with CLIP should be able to show results from my photos or both my photos and photos shared with me.
Basically, I would love the ability to optionally include any photos shared with me as completely part of my library, or not.

[Cebrain]

I also would like to see such a feature.
At the moment i have an share/folder in which are old family pictures which should be accessable from all users.
Still i don't want this pictures/videos in my own timeline, but wanna check them from time to time.

[GregTroar]

This is also exactly what I would be looking for.
Currently difficult to have my wife having the same view as mine in Immich while keeping the possibility to have her own login to save pictures from her phone.
I can share albums but she looses all possibility of having the map / explore available for the family's pictures.

[voc0der]

I landed here searching for the ability to have immich respect group claims from OIDC. Maybe for the sake of simplicity, that should be untangled from this?

1. Immich can use OIDC groups claim to authorize users to app and respect autoregister setting.
   ^ In my opinion, this doesn't need to be tied to any other request. It's a lot easier to do by itself. Many people are simply interested in restricting who has access to what OIDC group It's probable that most folks are sitting there waiting for a immich group claim to be respected without anything more complex.

For later, sure it could be more complex:

1. Admin Immich users can set from a select="multiple" list which OIDC groups (brought from claim) are shareable by users:
2. Users can assign a OIDC group as a share target. People in said group see said share. Done.
3. Any other complicated permissions things.

[dansity]

I'm here to up this request. The permissions must be group based, it is really weird that if someone adds an external library others cannot manage the photos in any way, it is bound to a single user. I cannot even favorite an image if it is part of an external library by another user. Since I'm new to immich I have imported 100Gb of photo and now I have a gallery I cannot manage in any way. If I add the external library with my username then my wife will not be able to manage any of the photos. It is just a lost game now. They are shared photos, we supposed to be able to manage them together.

[whitephoenix117]

From what I hear on the roadmap <https://immich.app/roadmap> fine grained access controls in conjunction with workflows are meant to address this as well as other permissions/ sharing related issues

…

On Thu, Jan 16, 2025 at 3:19 AM dansity ***@***.***> wrote: I'm here to up this request. The permissions must be group based, it is really weird that if someone adds an external library others cannot manage the photos in any way, it is bound to a single person. I cannot even favorite an image if it is part of an external library by another user. Since I'm new to immich I have imported 100Gb of photo and now I have a gallery I cannot manage in any way. If I add the external library with my username then my wife will not be able to manage any of the photos. It is just a lost game now. They are shared photos, we supposed to be able to manage them together. — Reply to this email directly, view it on GitHub <#1633 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACOBE6KVJLVNLSUBXJC57R32K5TPJAVCNFSM6AAAAABRPNWMD6VHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTCOBVGE4TKNA> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[ThomasLeister]

I second this feature request. I've only been a Immich user for about 2-3 weeks and I'm stunned by the general performance by this piece of software, but I'm really missing a user groups feature.

My use case:
Usually I'm the one who takes photos on family events or when I meet friends. After family events or friends meetings I create a new album and put the photos in it.

Now the photos are to be shared among all participants. I could do it via Links, yes, ... but that's not a permanent solution for your long term friends, because they might want to check out the photos again after years. A collection of links is not really helpful to them ;) So one would probably create user accounts for them and share all the albums to their Immich user accounts.

That works, but can be a ton of work to accomplish. Each album needs to be manually shared to all the specific users - one at a time.

It would be way easier to be able to define groups, such as:

• Close family
• Family and relatives
• Friends group 1
• Friends group 2
• etc.

Then I would share the albums to groups - not users.

I could add new users to their groups any time and they could also access albums that I've shared some time ago.

Would love to see this feature! Somehow it's currently preventing me from switching to Immich completely. For that "user group" feature I still need to use Nextcloud, which is not ideal for photos.

[NoBadDays]

This feature would help a lot, currently if a new user joins I need to go through all my albums and add them where needed.
And ask other users to do the same with their albums.

[Toan4th]

Came to third this. Family and groups of friends. Like each group is its own little space with its moments

[witc-git]

This could also be a way to implement some sort of group library where instead of Billy owning it and sharing with Suzy but Suzy not getting the explore benefits like people & places, the library would be owned by the 'Couple' group and all members of the group can see and add photos and get access to facial recognition and location on that shared library.
(I say library, but it could be a folder too if sub-folders become a thing)

[Toan4th]

True, and a simpler version of just having folders/nested albums could already get this thing going...sort of.