a560e08693 fix: re-evaluate OIDC role claim on every login and support array values (#29991)
* fix(server): re-evaluate OIDC role claim on every login and support array values

Previously the OIDC role claim (immich_role) was only read at user
auto-registration time and only accepted as a scalar string, so admin
status never updated after the first login and array-valued role/group
claims (common with Keycloak, Entra ID, etc.) were silently ignored.

Now the role claim is normalized from either a string or an array of
strings, and existing users have their isAdmin flag synced from the
claim on every login, keeping the IdP as the source of truth for
privileges while leaving isAdmin untouched when the claim is blank.

* fix(server): use .includes() instead of .some() for role claim check

Satisfies unicorn/prefer-includes lint rule flagged by CI.

* fix(server): resolve missing role claim to standard user and fix test mock

Default the OIDC role claim to 'user' when the IdP omits it so
auto-registration doesn't crash, and add the missing getAdmin mock in the
auth.service test so it correctly simulates an existing admin rather than
the first-user-registration path.

* fix: claim sync logic

---------

Co-authored-by: Jason Rasmussen <jrasm91@gmail.com>
2026-07-21 17:21:19 -04:00
2026-07-14 21:10:19 +00:00
2026-01-04 16:05:56 +00:00
2026-05-08 15:21:33 -04:00
2024-02-12 15:31:59 +00:00


License: AGPLv3 Discord

High performance self-hosted photo and video management solution



Català Español Français Italiano 日本語 한국어 Deutsch Nederlands Türkçe 简体中文 正體中文 Українська Русский Български Português Brasileiro Svenska العربية Tiếng Việt ภาษาไทย മലയാളം

Warning

⚠️ Always follow 3-2-1 backup plan for your precious photos and videos!

Note

You can find the main documentation, including installation guides, at https://immich.app/.

Demo

Access the demo here. For the mobile app, you can use https://demo.immich.app for the Server Endpoint URL.

Login credentials

Email Password
demo@immich.app demo

Features

Features Mobile Web
Upload and view videos and photos Yes Yes
Auto backup when the app is opened Yes N/A
Prevent duplication of assets Yes Yes
Selective album(s) for backup Yes N/A
Download photos and videos to local device Yes Yes
Multi-user support Yes Yes
Album and Shared albums Yes Yes
Scrubbable/draggable scrollbar Yes Yes
Support raw formats Yes Yes
Metadata view (EXIF, map) Yes Yes
Search by metadata, objects, faces, and CLIP Yes Yes
Administrative functions (user management) No Yes
Background backup Yes N/A
Virtual scroll Yes Yes
OAuth support Yes Yes
API Keys N/A Yes
LivePhoto/MotionPhoto backup and playback Yes Yes
Support 360 degree image display No Yes
User-defined storage structure Yes Yes
Public Sharing Yes Yes
Archive and Favorites Yes Yes
Global Map Yes Yes
Partner Sharing Yes Yes
Facial recognition and clustering Yes Yes
Memories (x years ago) Yes Yes
Offline support Yes No
Read-only gallery Yes Yes
Stacked Photos Yes Yes
Tags No Yes
Folder View Yes Yes

Translations

Read more about translations here.

Translation status

Repository activity

Activities

Star history

Star History Chart

Contributors

Languages
TypeScript 52.2%
Dart 29.7%
Svelte 13%
Python 1.5%
Kotlin 1.4%
Other 1.9%