Skip to content

feat(photos): log in to Immich through the stack's OIDC provider - #125

Merged
arthware-dev merged 1 commit into
mainfrom
feat/photos-oidc
Sep 23, 2026
Merged

arthware-dev merged 1 commit into
mainfrom
feat/photos-oidc

Conversation

@arthware-dev

Copy link
Copy Markdown
Contributor

Summary

  • With an OIDC provider installed and the photos stacklet registered, ./stack up photos turns on "Sign in with family account" in the Immich web UI and the mobile app. Accounts link by email; without a provider nothing changes.
  • Immich takes OAuth settings only through its system config, and its config file would lock every admin setting, so the stacklet writes five OAuth keys through the admin API and leaves every other setting, the password login included, as the admin set it.

When a stacklet that provides OpenID Connect is installed and has
registered the photos stacklet, `./stack up photos` turns on "Sign in
with family account" in the Immich web UI and the mobile app. Accounts
link by email. Without a provider nothing changes.

- Immich takes OAuth settings only through its system config. Its
  config file would replace that config and lock every admin setting,
  so the settings go in through the admin API instead.
- The stacklet owns five OAuth keys: on, issuer, client id, client
  secret, button text. Claims, auto signup, the password login and all
  other settings stay as the admin set them.
- Without credentials Immich is left alone, so a login set up by hand
  in the admin UI is kept. After the provider is destroyed its button
  stays until an admin turns OAuth off.
@arthware-dev
arthware-dev merged commit 4cb6f24 into main Sep 23, 2026
1 check passed
@arthware-dev
arthware-dev deleted the feat/photos-oidc branch September 23, 2026 19:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant