Identity provider configuration

Capability config shown here:

EDIT: I found in Immich’s documentation that the client type needs to be set to Confidential which is set by Client authentication turned on in Capability config