SSO

SSO Settings:

${Help}

Note: Making changes to this configuration requires a restart of Jellyfin.
This plug-in is in early development, not all configuration options have been implented in the UI, for example, SAML provider configuration has not been implemented.
See the help page and roadmap for more information.

Name of OID Provider:

The name used by Jellyfin to identify the OID provider.
If an OID provider with a matching name does not exist, a new provider with this name will be created.
If an OID provider with a matching name already exists, the settings for that provider will be updated.

OID Endpoint:

The OpenID endpoint. Must have a .well-known path available.

OpenID Client ID:

The OpenID client ID, for this media server instance. This is configured on the OIDC provider to uniquely identify this Jellyfin instance.

OID Secret:

The OpenID secret. Randomly generated & shared.

Enabled

Enable Authorization by Plugin

Determines if the plugin sets permissions for the user.
If false, the user will start with no permissions and an administrator will add permissions.
The permissions of existing users will not be rewritten on subsequent logins.

Enable All Folders

If enabled, all libraries will be accessible to any user that logs in through this provider.

Enabled Folders:

Determines which libraries will be accessible to a user that logs in through this provider.
If "Enable All Folders" is checked, then this has no effect.

Roles:

A list of roles, one role per-line to look for in the OpenID response.
If a user has any of these roles, then the user is authenticated. This validates the OpenID response against the claim set in "RoleClaim".
Leave blank to disable role checking.

Admin Roles:

A list of roles, one role per-line to look for in the OpenID response.
Like "Roles", but having any of the roles confers admin privilege.
If unset will not grant admin privileges.

Enable Role-Based Folder Access:

Determines if user roles should be used to control library access.

Folder Role Mapping:

Map roles (given by "Role Claim") to lists of libraries. If a user has a given role, they will have access to the corresponding libraries. If "Enable Role-Based Folder Access" is disabled, has no effect.

Role Claim:

This is the value in the OpenID response to check for roles. The first element is the claim type, the subsequent values are to parse the JSON of the claim value. Use a "\." to denote a literal ".". This expects a list of strings from the OIDC server.
For Keycloak, it is realm_access.roles by default.
For Authelia, it is groups

Request Additional Scopes:

Specify additional scopes to include in the OIDC request.
One scope per line, each line should contain a scope name to include in the OIDC request.
For some OIDC providers (For example, authelia), additional scopes may be required in order to validate group membership in role claim.
Leave blank to only request the default scopes.

Set default Provider:

The set provider then gets assigned to the user after they have logged in. If it is not set, nothing is changed. With this, a user can login with SSO but is still able to log in via other providers later.
A common option is Jellyfin.Server.Implementations.Users.DefaultAuthenticationProvider for the default provider.