immich-app/immich · error · BadRequestException

Received backchannel logout request but OAuth is not enabled

Error message

Received backchannel logout request but OAuth is not enabled

What it means

Thrown by AuthService.backchannelLogout when a back-channel logout request arrives but the server's oauth.enabled config is false. The OpenID Connect back-channel logout endpoint is only valid when OAuth is configured, so any request to it while OAuth is disabled is rejected with 400 BadRequest.

Source

Thrown at server/src/services/auth.service.ts:96

  async logout(auth: AuthDto, authType: AuthType): Promise<LogoutResponseDto> {
    let oauthBearerToken: string | undefined;
    if (auth.session) {
      const session = await this.sessionRepository.get(auth.session.id);
      oauthBearerToken = session?.oauthBearerToken ?? undefined;
      await this.sessionRepository.delete(auth.session.id);
      await this.eventRepository.emit('SessionDelete', { sessionId: auth.session.id });
    }

    return {
      successful: true,
      redirectUri: await this.getLogoutEndpoint(authType, oauthBearerToken),
    };
  }

  async backchannelLogout(dto: OAuthBackchannelLogoutDto): Promise<void> {
    const { oauth } = await this.getConfig({ withCache: false });
    if (!oauth.enabled) {
      throw new BadRequestException('Received backchannel logout request but OAuth is not enabled');
    }

    let claims;
    try {
      claims = await this.oauthRepository.validateLogoutToken(oauth, dto.logout_token);
    } catch (error: Error | any) {
      this.logger.error(`Error backchannel logout: ${error.message}`);
      this.logger.error(error);

      throw new BadRequestException('Error backchannel logout: token validation failed');
    }

    if (!claims) {
      throw new BadRequestException('Invalid logout token: no claims found');
    }

    if (!claims.sub && !claims.sid) {
      throw new BadRequestException('Invalid logout token: it must contain either a sub or a sid claim');

View on GitHub (pinned to 199723261c)

Solutions

1. Re-enable OAuth in server system config if back-channel logout is expected.
2. Remove the back-channel logout URL from the IdP client configuration if OAuth is intentionally disabled.
3. Ensure the IdP points at an instance that actually has OAuth enabled.

// Check OAuth is enabled before expecting back-channel logout to work.
const { data: oauth } = await api.get('/oauth/config');
if (!oauth.enabled) {
  throw new Error('OAuth disabled; back-channel logout will be rejected.');
}

When it happens

Trigger: The Identity Provider (IdP) sends a back-channel logout to /oauth/backchannel-logout (or equivalent) but the server has oauth.enabled=false; admin disabled OAuth without updating the IdP's registered logout endpoint.

Common situations: OAuth was turned off in server config while the IdP still has the back-channel URL registered; misrouted logout callback hitting the wrong instance; staging/prod config drift where one environment has OAuth off.

Related errors

• Error backchannel logout: token validation failed
• Invalid logout token: no claims found
• Invalid logout token: it must contain either a sub or a sid
• Password login has been disabled
• OAuth is not enabled

AI-assisted analysis of immich-app/immich@199723261c (2026-08-12). Data as JSON: /api/errors/693b95ca92d96781. Report an issue: GitHub.