[Feature] PKCE Support?

[KenMacD]

The feature

I tried setting up Oauth2 with Kanidm, but I see the PKCE features of the the openid client aren't in use. Any plans to support them?

The openid-client quickstart includes instructions that might help.

Platform

• Server
• Web
• Mobile

[ToxicMushroom]

Also see https://kanidm.github.io/kanidm/master/frequently_asked_questions.html#why-is-disabling-pkce-considered-insecure

[ToxicMushroom]

Looks like they added: b7a0cf2
Though I didn't see it in the changelog

[ToxicMushroom]

I re-enabled pkce for immich in kanidm and it seems to work now :)

[provokateurin]

I also tried it and it seems to work, however it is still expected that you provide a client secret which is not necessary for PKCE. For now I just put a dummy value for the secret and there are no issues with doing so it seems. I've opened #18826 about that.

[ToxicMushroom]

I'm not sure I follow. Are you saying Immich became a public client ?

[provokateurin]

Yeah so public enforces PKCE and then no client secret is needed.

[ToxicMushroom]

I don't see that reflected in the docs
I also would love to see the reasoning for making Immich a public client ?

per https://oauth.net/2/pkce/

PKCE is recommended even if a client is using a client secret or other form of client authentication like private_key_jwt.

Currently what you're describing to me feels like: adding guards (PKCE) next to your locked door (confidential) and the removing the locks (making public) because we have guards now.