You must log in or register to comment.
One thing I hate about Immich: Their absolute refusal to bake in basic TOTP auth.
Isn’t that generally what external auth providers are designed for?
I imagine it isn’t much of a concern if Immich isn’t exposed to the internet.
IMHO, I kinda agree with their decision. I see basic auth as just that, user and pass. Anything else should use a proper solution, and there are tons of excellent options.
If you want to go the extra mile, you can roll immich with Autelia / Authentik etc. IDP, and use TOTP on that layer.
One problem is that it’s not much use applying secondary auth methods on the server side if the mobile app can’t use them.
