feat(server)!: oauth encryption algorithm setting (#6818)

* feat: add oauth signing algorithm setting

* chore: open api

* chore: change default to RS256

* feat: test and clean up

---------

Co-authored-by: Jason Rasmussen <jrasm91@gmail.com>

docs/docs/administration/oauth.md

@@ -66,8 +66,10 @@ Once you have a new OAuth client application configured, Immich can be configure
 | Client ID                                            | string  | (required)           | Required. Client ID (from previous step)                                            |
 | Client Secret                                        | string  | (required)           | Required. Client Secret (previous step)                                             |
 | Scope                                                | string  | openid email profile | Full list of scopes to send with the request (space delimited)                      |
+| Signing Algorithm                                    | string  | RS256                | The algorithm used to sign the id token (examples: RS256, HS256)                    |
 | Button Text                                          | string  | Login with OAuth     | Text for the OAuth button on the web                                                |
 | Auto Register                                        | boolean | true                 | When true, will automatically register a user the first time they sign in           |
+| Storage Claim                                        | string  | preferred_username   | Claim mapping for the user's storage label                                          |
 | [Auto Launch](#auto-launch)                          | boolean | false                | When true, will skip the login page and automatically start the OAuth login process |
 | [Mobile Redirect URI Override](#mobile-redirect-uri) | URL     | (empty)              | Http(s) alternative mobile redirect URI                                             |
 

open-api/immich-openapi-specs.json

@@ -9679,6 +9679,9 @@
           "scope": {
             "type": "string"
           },
+          "signingAlgorithm": {
+            "type": "string"
+          },
           "storageLabelClaim": {
             "type": "string"
           }
@@ -9694,6 +9697,7 @@
           "mobileOverrideEnabled",
           "mobileRedirectUri",
           "scope",
+          "signingAlgorithm",
           "storageLabelClaim"
         ],
         "type": "object"

open-api/typescript-sdk/client/api.ts

@@ -4073,6 +4073,12 @@ export interface SystemConfigOAuthDto {
      * @memberof SystemConfigOAuthDto
      */
     'scope': string;
+    /**
+     * 
+     * @type {string}
+     * @memberof SystemConfigOAuthDto
+     */
+    'signingAlgorithm': string;
     /**
      * 
      * @type {string}

server/src/domain/auth/auth.service.spec.ts

@@ -73,7 +73,7 @@ describe('AuthService', () => {
 
     jest.spyOn(generators, 'state').mockReturnValue('state');
     jest.spyOn(Issuer, 'discover').mockResolvedValue({
-      id_token_signing_alg_values_supported: ['HS256'],
+      id_token_signing_alg_values_supported: ['RS256'],
       Client: jest.fn().mockResolvedValue({
         issuer: {
           metadata: {

server/src/domain/auth/auth.service.ts

@@ -318,12 +318,25 @@ export class AuthService {
     const redirectUri = this.normalize(config, url.split('?')[0]);
     const client = await this.getOAuthClient(config);
     const params = client.callbackParams(url);
+    try {
       const tokens = await client.callback(redirectUri, params, { state: params.state });
       return client.userinfo<OAuthProfile>(tokens.access_token || '');
+    } catch (error: Error | any) {
+      if (error.message.includes('unexpected JWT alg received')) {
+        this.logger.warn(
+          [
+            'Algorithm mismatch. Make sure the signing algorithm is set correctly in the OAuth settings.',
+            'Or, that you have specified a signing key in your OAuth provider.',
+          ].join(' '),
+        );
+      }
+
+      throw error;
+    }
   }
 
   private async getOAuthClient(config: SystemConfig) {
-    const { enabled, clientId, clientSecret, issuerUrl } = config.oauth;
+    const { enabled, clientId, clientSecret, issuerUrl, signingAlgorithm } = config.oauth;
 
     if (!enabled) {
       throw new BadRequestException('OAuth2 is not enabled');
@@ -337,10 +350,7 @@ export class AuthService {
 
     try {
       const issuer = await Issuer.discover(issuerUrl);
-      const algorithms = (issuer.id_token_signing_alg_values_supported || []) as string[];
+      metadata.id_token_signed_response_alg = signingAlgorithm;
-      if (algorithms[0] === 'HS256') {
-        metadata.id_token_signed_response_alg = algorithms[0];
-      }
 
       return new issuer.Client(metadata);
     } catch (error: any | AggregateError) {

server/src/domain/system-config/dto/system-config-oauth.dto.ts

@@ -5,12 +5,13 @@ const isOverrideEnabled = (config: SystemConfigOAuthDto) => config.mobileOverrid
 
 export class SystemConfigOAuthDto {
   @IsBoolean()
-  enabled!: boolean;
+  autoLaunch!: boolean;
+
+  @IsBoolean()
+  autoRegister!: boolean;
 
-  @ValidateIf(isEnabled)
-  @IsNotEmpty()
   @IsString()
-  issuerUrl!: string;
+  buttonText!: string;
 
   @ValidateIf(isEnabled)
   @IsNotEmpty()
@@ -22,20 +23,13 @@ export class SystemConfigOAuthDto {
   @IsString()
   clientSecret!: string;
 
-  @IsString()
-  scope!: string;
-
-  @IsString()
-  storageLabelClaim!: string;
-
-  @IsString()
-  buttonText!: string;
-
   @IsBoolean()
-  autoRegister!: boolean;
+  enabled!: boolean;
 
-  @IsBoolean()
+  @ValidateIf(isEnabled)
-  autoLaunch!: boolean;
+  @IsNotEmpty()
+  @IsString()
+  issuerUrl!: string;
 
   @IsBoolean()
   mobileOverrideEnabled!: boolean;
@@ -43,4 +37,14 @@ export class SystemConfigOAuthDto {
   @ValidateIf(isOverrideEnabled)
   @IsUrl()
   mobileRedirectUri!: string;
+
+  @IsString()
+  scope!: string;
+
+  @IsString()
+  @IsNotEmpty()
+  signingAlgorithm!: string;
+
+  @IsString()
+  storageLabelClaim!: string;
 }

server/src/domain/system-config/system-config.core.ts

@@ -88,17 +88,18 @@ export const defaults = Object.freeze<SystemConfig>({
     enabled: true,
   },
   oauth: {
-    enabled: false,
+    autoLaunch: false,
-    issuerUrl: '',
+    autoRegister: true,
+    buttonText: 'Login with OAuth',
     clientId: '',
     clientSecret: '',
+    enabled: false,
+    issuerUrl: '',
     mobileOverrideEnabled: false,
     mobileRedirectUri: '',
     scope: 'openid email profile',
+    signingAlgorithm: 'RS256',
     storageLabelClaim: 'preferred_username',
-    buttonText: 'Login with OAuth',
-    autoRegister: true,
-    autoLaunch: false,
   },
   passwordLogin: {
     enabled: true,

server/src/domain/system-config/system-config.service.spec.ts

@@ -98,6 +98,7 @@ const updatedConfig = Object.freeze<SystemConfig>({
     mobileOverrideEnabled: false,
     mobileRedirectUri: '',
     scope: 'openid email profile',
+    signingAlgorithm: 'RS256',
     storageLabelClaim: 'preferred_username',
   },
   passwordLogin: {

server/src/infra/entities/system-config.entity.ts

@@ -77,17 +77,18 @@ export enum SystemConfigKey {
 
   NEW_VERSION_CHECK_ENABLED = 'newVersionCheck.enabled',
 
-  OAUTH_ENABLED = 'oauth.enabled',
+  OAUTH_AUTO_LAUNCH = 'oauth.autoLaunch',
-  OAUTH_ISSUER_URL = 'oauth.issuerUrl',
+  OAUTH_AUTO_REGISTER = 'oauth.autoRegister',
+  OAUTH_BUTTON_TEXT = 'oauth.buttonText',
   OAUTH_CLIENT_ID = 'oauth.clientId',
   OAUTH_CLIENT_SECRET = 'oauth.clientSecret',
-  OAUTH_SCOPE = 'oauth.scope',
+  OAUTH_ENABLED = 'oauth.enabled',
-  OAUTH_STORAGE_LABEL_CLAIM = 'oauth.storageLabelClaim',
+  OAUTH_ISSUER_URL = 'oauth.issuerUrl',
-  OAUTH_AUTO_LAUNCH = 'oauth.autoLaunch',
-  OAUTH_BUTTON_TEXT = 'oauth.buttonText',
-  OAUTH_AUTO_REGISTER = 'oauth.autoRegister',
   OAUTH_MOBILE_OVERRIDE_ENABLED = 'oauth.mobileOverrideEnabled',
   OAUTH_MOBILE_REDIRECT_URI = 'oauth.mobileRedirectUri',
+  OAUTH_SCOPE = 'oauth.scope',
+  OAUTH_SIGNING_ALGORITHM = 'oauth.signingAlgorithm',
+  OAUTH_STORAGE_LABEL_CLAIM = 'oauth.storageLabelClaim',
 
   PASSWORD_LOGIN_ENABLED = 'passwordLogin.enabled',
 
@@ -216,17 +217,18 @@ export interface SystemConfig {
     enabled: boolean;
   };
   oauth: {
-    enabled: boolean;
+    autoLaunch: boolean;
-    issuerUrl: string;
+    autoRegister: boolean;
+    buttonText: string;
     clientId: string;
     clientSecret: string;
-    scope: string;
+    enabled: boolean;
-    storageLabelClaim: string;
+    issuerUrl: string;
-    buttonText: string;
-    autoRegister: boolean;
-    autoLaunch: boolean;
     mobileOverrideEnabled: boolean;
     mobileRedirectUri: string;
+    scope: string;
+    signingAlgorithm: string;
+    storageLabelClaim: string;
   };
   passwordLogin: {
     enabled: boolean;

web/src/api/utils.ts

@@ -45,8 +45,10 @@ export const oauth = {
       const redirectUri = location.href.split('?')[0];
       const { data } = await api.oauthApi.startOAuth({ oAuthConfigDto: { redirectUri } });
       window.location.href = data.url;
+      return true;
     } catch (error) {
       handleError(error, 'Unable to login with OAuth');
+      return false;
     }
   },
   login: (location: Location) => {

web/src/lib/components/admin-page/settings/oauth/oauth-settings.svelte

@@ -69,7 +69,9 @@
         >.
       </p>
 
-      <SettingSwitch {disabled} title="ENABLE" bind:checked={config.oauth.enabled} />
+      <SettingSwitch {disabled} title="ENABLE" subtitle="Login with OAuth" bind:checked={config.oauth.enabled} />
+
+      {#if config.oauth.enabled}
         <hr />
         <SettingInputField
           inputType={SettingInputFieldType.TEXT}
@@ -107,13 +109,22 @@
           isEdited={!(config.oauth.scope == savedConfig.oauth.scope)}
         />
 
+        <SettingInputField
+          inputType={SettingInputFieldType.TEXT}
+          label="SIGNING ALGORITHM"
+          bind:value={config.oauth.signingAlgorithm}
+          required={true}
+          disabled={disabled || !config.oauth.enabled}
+          isEdited={!(config.oauth.signingAlgorithm == savedConfig.oauth.signingAlgorithm)}
+        />
+
         <SettingInputField
           inputType={SettingInputFieldType.TEXT}
           label="STORAGE LABEL CLAIM"
           desc="Automatically set the user's storage label to the value of this claim."
           bind:value={config.oauth.storageLabelClaim}
           required={true}
-        disabled={disabled || !config.oauth.storageLabelClaim}
+          disabled={disabled || !config.oauth.enabled}
           isEdited={!(config.oauth.storageLabelClaim == savedConfig.oauth.storageLabelClaim)}
         />
 
@@ -158,6 +169,7 @@
             isEdited={!(config.oauth.mobileRedirectUri == savedConfig.oauth.mobileRedirectUri)}
           />
         {/if}
+      {/if}
 
       <SettingButtonsRow
         on:reset={({ detail }) => dispatch('reset', { ...detail, configKeys: ['oauth'] })}

web/src/lib/components/forms/login-form.svelte

@@ -89,7 +89,11 @@
   const handleOAuthLogin = async () => {
     oauthLoading = true;
     oauthError = '';
-    await oauth.authorize(window.location);
+    const success = await oauth.authorize(window.location);
+    if (!success) {
+      oauthLoading = false;
+      oauthError = 'Unable to login with OAuth';
+    }
   };
 </script>