Add kanidm config steps

README.md

@@ -47,6 +47,7 @@ This is 100% alpha software! PRs are welcome to improve the code.
 - Keycloak
   - OIDC & SAML
 - Pocket ID
+- Kanidm
 - Google OpenID: Works, but usernames are all numeric
 
 ## Supported Protocols

providers.md

@@ -254,3 +254,49 @@ pocketid:
   Roles: users  # (optional) The pocket id group which will give a user Jellyfin access
   AvatarUrlFormat: @{picture} # (optional) This will pull each users pocket id photo into Jellyfin
 ```
+
+## Kanidm
+
+Kanidm is a modern and simple identity management platform written in rust.
+
+### Kanidm Config
+
+```shell
+kanidm system oauth2 create jellyfin "Jellyfin" https://jellyfin.example.com/
+
+# Set this to drop the trailing @idm.example.com in usernames
+kanidm system oauth2 prefer-short-username jellyfin
+
+kanidm system oauth2 add-redirect-url jellyfin https://jellyfin.example.com/sso/OID/redirect/kanidm
+kanidm system oauth2 add-redirect-url jellyfin https://jellyfin.example.com/sso/OID/r/kanidm
+
+# Optionally setup groups for Jellyfin
+kanidm group create jellyfin_admins
+kanidm group create jellyfin_users
+
+kanidm system oauth2 update-scope-map jellyfin jellyfin_admins openid profile groups
+kanidm system oauth2 update-scope-map jellyfin jellyfin_users openid profile groups
+```
+Get the secret used in the Jellyfin config with `kanidm system oauth2 show-basic-secret jellyfin`.
+
+### Jellyfin's Config
+
+```yaml
+kanidm:
+  OidEndpoint: https://idm.example.com/oauth2/openid/jellyfin/
+  OidClientId: jellyfin
+  OidSecret: <kanidm-secret>
+  # (optional) If you want Jellyfin to read group permissions from kanidm
+  EnableAuthorization: true
+  OidScopes:
+    - groups
+  RoleClaim: groups
+  AdminsRoles:
+    - [email protected]
+  Roles:
+    - [email protected]
+    # If in your setup admin accounts aren't members of the users group you need to add the admins group to roles as well
+    - [email protected]
+  # (optional) If you want the name attribute instead of the spn attribute as username
+  DefaultUsernameClaim: preferred_username
+```