dtoro/mule-image
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(compose): pass OIDC env vars under the names PhotoPrism actually reads

Browse Source 
The compose file was using PHOTOPRISM_OIDC_ISSUER_URL / _CLIENT_ID /
_CLIENT_SECRET / _PROVIDER_NAME / _REDIRECT_URI, but PhotoPrism's CLI
flags are --oidc-uri / --oidc-client / --oidc-secret / --oidc-provider —
so the env vars it parses are PHOTOPRISM_OIDC_URI / _CLIENT / _SECRET /
_PROVIDER. With the old names PhotoPrism silently ignored them, OIDC
stayed dormant, and `photoprism show config` reported blank oidc-uri /
oidc-client even though everything else looked configured.

Confirmed on the M0 LXC: renaming the env vars makes the Authentik
"Sign in" button appear on /library/login, /api/v1/oidc/login emits a
proper 302 to the IdP authorize endpoint, and the callback creates the
OIDC user + session in the DB.

The user-facing `.env.photoprism` keys are unchanged (OIDC_PROVIDER_NAME,
OIDC_ISSUER_URL, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET); the compose file
just maps them to the correct PHOTOPRISM_* targets. OIDC_REDIRECT_URI
is removed because PhotoPrism derives the redirect from PHOTOPRISM_SITE_URL.
This commit is contained in:
Claudio
2026-05-17 22:56:07 +02:00
parent 7e10f0b462
commit cce1d876c3
2 changed files with 20 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
.env.photoprism.example
View File

@@ -51,14 +51,18 @@ PP_GID=1000
# ── OIDC SSO (Authentik or equivalent) ───────────────────────────────────────
# Leave blank to keep OIDC dormant. Fill in to enable the "Sign in with OIDC"
# button on the login page; per plan, OIDC_REGISTER=true auto-creates
# accounts at role `user`.
# button on the login page; OIDC_REGISTER=true auto-creates accounts at role
# `user` (override to `admin` to grant full access on first SSO login).
#
# The compose file reads these and maps them to PhotoPrism's actual env-var
# names (PHOTOPRISM_OIDC_URI / _CLIENT / _SECRET / _PROVIDER) — see the
# comment in docker-compose.photoprism.yml. The PhotoPrism callback URI is
# auto-derived from PP_SITE_URL; do not set it manually.
# OIDC_PROVIDER_NAME=Authentik
# OIDC_ISSUER_URL=https://auth.example.com/application/o/photoprism/
# OIDC_CLIENT_ID=...
# OIDC_CLIENT_SECRET=...
# OIDC_REDIRECT_URI=http://localhost:2342/api/v1/oidc/redirect
# OIDC_SCOPES=openid profile email
# OIDC_REGISTER=true
# OIDC_ROLE=user

18
docker-compose.photoprism.yml
View File

@@ -107,14 +107,22 @@ services:
PHOTOPRISM_DISABLE_EXIFTOOL: "false"
# OIDC — set in .env.photoprism when the IdP (Authentik) is wired up.
# Empty values keep OIDC dormant; the username/password login still works.
PHOTOPRISM_OIDC_PROVIDER_NAME: ${OIDC_PROVIDER_NAME:-}
PHOTOPRISM_OIDC_ISSUER_URL: ${OIDC_ISSUER_URL:-}
PHOTOPRISM_OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-}
PHOTOPRISM_OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-}
PHOTOPRISM_OIDC_REDIRECT_URI: ${OIDC_REDIRECT_URI:-}
# PhotoPrism's CLI flags are --oidc-uri / --oidc-client / --oidc-secret
# / --oidc-provider, so the env-var names it actually reads are
# PHOTOPRISM_OIDC_URI / _CLIENT / _SECRET / _PROVIDER (NOT _ISSUER_URL
# / _CLIENT_ID / _CLIENT_SECRET / _PROVIDER_NAME — those are silently
# ignored, OIDC stays dormant, and `photoprism show config` reports
# blank oidc-uri / oidc-client). PHOTOPRISM_OIDC_REDIRECT is a bool
# (auto-redirect-from-/library/login), not a URL — PhotoPrism builds
# the callback from PHOTOPRISM_SITE_URL.
PHOTOPRISM_OIDC_PROVIDER: ${OIDC_PROVIDER_NAME:-${OIDC_PROVIDER:-}}
PHOTOPRISM_OIDC_URI: ${OIDC_ISSUER_URL:-${OIDC_URI:-}}
PHOTOPRISM_OIDC_CLIENT: ${OIDC_CLIENT_ID:-${OIDC_CLIENT:-}}
PHOTOPRISM_OIDC_SECRET: ${OIDC_CLIENT_SECRET:-${OIDC_SECRET:-}}
PHOTOPRISM_OIDC_SCOPES: ${OIDC_SCOPES:-openid profile email}
PHOTOPRISM_OIDC_REGISTER: ${OIDC_REGISTER:-true}
PHOTOPRISM_OIDC_ROLE: ${OIDC_ROLE:-user}
PHOTOPRISM_OIDC_REDIRECT: ${OIDC_REDIRECT:-false}
working_dir: /photoprism
volumes:
# Existing photo library — mounted read-only in M0; flip to :rw in M2