3.1.0.1 release

Facebook only officially supports oauth2, not OpenID. Therefore, they are not officially compatible with this plugin.

README.md

@@ -1,6 +1,6 @@
 # Jellyfin SSO Plugin
 
-This plugin allows users to sign in through an SSO provider (such as Google, Facebook, or your own provider). This enables one-click signin.
+This plugin allows users to sign in through an SSO provider (such as Google, Microsoft, or your own provider). This enables one-click signin.
 
 https://user-images.githubusercontent.com/17993169/149681516-f93b43f5-fa5c-4c1f-a909-e5414878a864.mp4
 
@@ -12,6 +12,8 @@ There is NO admin configuration! You must use the API to configure the program!
 
 **This is for Jellyfin 10.8**
 
+**This README reflects the __main__ branch! Switch tags to view version-specific documentation!**
+
 ## Tested Providers
 
 - Google OpenID: Works, but usernames are all numeric
@@ -46,6 +48,7 @@ Build the zipped plugin with `jprm --verbosity=debug plugin build .`.
 - [ ] Automated tests
 - [x] Add role/claims support
 - [ ] Use canonical usernames instead of preferred usernames
+- [ ] Finalize RBAC access for all user properties
 
 ## Examples
 
@@ -53,7 +56,7 @@ Build the zipped plugin with `jprm --verbosity=debug plugin build .`.
 
 Example for adding a SAML configuration with the API using [curl](https://curl.se/):
 
-`curl -v -X POST -H "Content-Type: application/json" -d '{"samlEndpoint": "https://keycloak.example.com/realms/test/protocol/saml", "samlClientId": "jellyfin-saml", "samlCertificate": "Very long base64 encoded string here", "enabled": true, "enableAllFolders": true, "enabledFolders": ["folder1", "folder2"], "adminRoles": [], "roles": []}' "https://myjellyfin.example.com/sso/SAML/Add?api_key=API_KEY_HERE"`
+`curl -v -X POST -H "Content-Type: application/json" -d '{"samlEndpoint": "https://keycloak.example.com/realms/test/protocol/saml", "samlClientId": "jellyfin-saml", "samlCertificate": "Very long base64 encoded string here", "enabled": true, "enableAuthorization": true, "enableAllFolders": false, "enabledFolders": [], "adminRoles": ["jellyfin-admin"], "roles": ["allowed-to-use-jellyfin"], "enableFolderRoles": true, "folderRoleMapping": [{"role": "allowed-to-watch-movies", "folders": ["cc7df17e2f3509a4b5fc1d1ff0a6c4d0", "f137a2dd21bbc1b99aa5c0f6bf02a805"]}]}' "https://myjellyfin.example.com/sso/SAML/Add?api_key=API_KEY_HERE"`
 
 Make sure that the JSON is the same as the configuration you would like.
 
@@ -72,7 +75,7 @@ Make sure that `clientid` is replaced with the actual client ID!
 
 Example for adding an OpenID configuration with the API using [curl](https://curl.se/)
 
-`curl -v -X POST -H "Content-Type: application/json" -d '{"oidEndpoint": "https://keycloak.example.com/realms/test", "oidClientId": "jellyfin-oid", "oidSecret": "short secret here", "enabled": true, "enableAllFolders": true, "enabledFolders": ["folder3", "folder4"], "adminRoles": [], "roles": []}' "https://myjellyfin.example.com/sso/OID/Add?api_key=API_KEY_HERE"`
+`curl -v -X POST -H "Content-Type: application/json" -d '{"oidEndpoint": "https://keycloak.example.com/realms/test", "oidClientId": "jellyfin-oid", "oidSecret": "short secret here", "enabled": true, "enableAuthorization": true, "enableAllFolders": false, "enabledFolders": [], "adminRoles": ["jellyfin-admin"], "roles": ["allowed-to-use-jellyfin"], "enableFolderRoles": true, "folderRoleMapping": [{"role": "allowed-to-watch-movies", "folders": ["cc7df17e2f3509a4b5fc1d1ff0a6c4d0", "f137a2dd21bbc1b99aa5c0f6bf02a805"]}], "roleClaim": "realm_access"}' "https://myjellyfin.example.com/sso/OID/Add?api_key=API_KEY_HERE"`
 
 The OpenID provider must have the following configuration (again, I am using Keycloak)
 
@@ -110,10 +113,13 @@ These all require authorization. Append an API key to the end of the request: `c
   - `samlClientId`: string. The SAML client ID.
   - `samlCertificate`: string. The base64 encoded SAML certificate.
   - `enabled`: boolean. Determines if the provider is enabled or not.
+  - `enableAuthorization`: boolean: Determines if the plugin sets permissions for the user. If false, the user will start with no permissions and an administrator will add permissions. The permissions of existing users will not be rewritten on subsequent logins.
   - `enableAllFolders`: boolean. Determines if the client logging in is allowed access to all folders.
   - `enabledFolders`: array of strings. If `enableAllFolders` is set to false, then this will be used to determine what folders the users who log in through this provider are allowed to use.
   - `roles`: array of strings. This validates the SAML response against the `Role` attribute. If a user has any of these roles, then the user is authenticated. Leave blank to disable role checking.
   - `adminRoles`: array of strings. This uses SAML response's `Role` attributes. If a user has any of these roles, then the user is an admin. Leave blank to disable (default is to not enable admin permissions).
+  - `enableFolderRoles`: boolean. Determines if role-based folder access should be used.
+  - `folderRoleMapping`: object in the format "role": string and "folders": array of strings. The user with this role will have access to the following folders if `enableFolderRoles` is enabled. To get the IDs of the folders, GET the `/Library/MediaFolders` URL with an API key. Look for the `Id` attribute.
 - GET `SAML/Del/clientId`: This removes a configuration for SAML for a given client ID.
 - GET `SAML/Get`: Lists the configurations currently available.
 
@@ -141,14 +147,22 @@ These all require authorization. Append an API key to the end of the request: `c
   - `oidClientId`: string. The OpenID client ID.
   - `oidSecret`: string. The OpenID secret.
   - `enabled`: boolean. Determines if the provider is enabled or not.
+  - `enableAuthorization`: boolean: Determines if the plugin sets permissions for the user. If false, the user will start with no permissions and an administrator will add permissions. The permissions of existing users will not be rewritten on subsequent logins.
   - `enableAllFolders`: boolean. Determines if the client logging in is allowed access to all folders.
   - `enabledFolders`: array of strings. If `enableAllFolders` is set to false, then this will be used to determine what folders the users who log in through this provider are allowed to use.
-  - `roles`: array of strings. This validates the OpenID response against the `realm_access` claim. If a user has any of these roles, then the user is authenticated. Leave blank to disable role checking. This currently only works for Keycloak (to my knowledge).
-  - `adminRoles`: array of strings. This uses the OpenID response against the `realm_access` claim. If a user has any of these roles, then the user is an admin. Leave blank to disable (default is to not enable admin permissions).
+  - `roles`: array of strings. This validates the OpenID response against the claim set in `roleClaim`. If a user has any of these roles, then the user is authenticated. Leave blank to disable role checking. This currently only works for Keycloak (to my knowledge).
+  - `adminRoles`: array of strings. This uses the OpenID response against the claim set in `roleClaim`. If a user has any of these roles, then the user is an admin. Leave blank to disable (default is to not enable admin permissions).
+  - `enableFolderRoles`: boolean. Determines if role-based folder access should be used.
+  - `folderRoleMapping`: object in the format "role": string and "folders": array of strings. The user with this role will have access to the following folders if `enableFolderRoles` is enabled. To get the IDs of the folders, GET the `/Library/MediaFolders` URL with an API key. Look for the `Id` attribute.
+  - `roleClaim`: string. This is the value in the OpenID response to check for roles. For Keycloak, it is `realm_access` by default.
 - GET `OID/Del/clientId`: This removes a configuration for OpenID for a given client ID.
 - GET `OID/Get`: Lists the configurations currently available.
 - GET `OID/States`: Lists currently active OpenID flows in progress.
 
+### Misc
+
+- POST `Unregister/username`: This "unregisters" a user from SSO. A JSON-formatted string must be posted with the new authentication provider. To reset to the default provider, use `Jellyfin.Server.Implementations.Users.DefaultAuthenticationProvider` like so: `curl -X POST -H "Content-Type: application/json" -d '"Jellyfin.Server.Implementations.Users.DefaultAuthenticationProvider"' "https://myjellyfin.example.com/sso/Unregister/username?api_key=API_KEY`
+
 ## Limitations
 
 There is no GUI to sign in. You have to make it yourself! The buttons should redirect to something like this: [https://myjellyfin.example.com/sso/SAML/p/clientid](https://myjellyfin.example.com/sso/SAML/p/clientid) replacing `clientid` with the provider client ID and `SAML` with the auth scheme (either `SAML` or `OID`).
@@ -159,7 +173,7 @@ There is also no logout callback. Logging out of Jellyfin will log you out of Je
 
 ~~This only supports Jellyfin on it's own domain (for now). This is because I'm using string concatenation for generating some URLs. A PR is welcome to patch this.~~ Fixed in [PR #1](https://github.com/9p4/jellyfin-plugin-sso/pull/1).
 
-**This only works on the web UI**. The user must open the Jellyfin web UI BEFORE using the SSO program to populate some values in the localStorage.
+**This only works on the web UI**. ~~The user must open the Jellyfin web UI BEFORE using the SSO program to populate some values in the localStorage.~~ Fixed by implementing a comment by [Pfuenzle](https://github.com/Pfuenzle) in [Issue #5](https://github.com/9p4/jellyfin-plugin-sso/issues/5#issuecomment-1041864820).
 
 ## Credits and Thanks
 
@@ -170,3 +184,7 @@ I use the [AspNet SAML](https://github.com/jitbit/AspNetSaml/) library for the S
 I use the [IdentityModel OIDC Client](https://github.com/IdentityModel/IdentityModel.OidcClient/) library for the OpenID side of things.
 
 Thanks to these projects, without which I would have been pulling my hair out implementing these protocols from scratch.
+
+## Something funny about the origins of this plugin
+
+It totally slipped my mind, but I had [requested this functionality a few years back](https://github.com/jellyfin/jellyfin/issues/2012). What goes around comes around, I guess.

SSO-Auth/Api/SSOController.cs

@@ -2,7 +2,6 @@ using System;
 using System.Collections.Generic;
 using System.Net.Mime;
 using System.Threading.Tasks;
-using IdentityModel.Client;
 using IdentityModel.OidcClient;
 using Jellyfin.Data.Entities;
 using Jellyfin.Data.Enums;
@@ -68,6 +67,13 @@ public class SSOController : ControllerBase
                     return Content("Something went wrong...", MediaTypeNames.Text.Plain);
                 }
 
+                if (!config.EnableFolderRoles)
+                {
+                    StateManager[Request.Query["state"]].Folders = new List<string>(config.EnabledFolders);
+                } else {
+                    StateManager[Request.Query["state"]].Folders = new List<string>();
+                }
+
                 foreach (var claim in result.User.Claims)
                 {
                     if (claim.Type == "preferred_username")
@@ -79,15 +85,16 @@ public class SSOController : ControllerBase
                         }
                     }
 
-                    // Check if allowed to login based on realm roles
-                    if (config.Roles.Length != 0)
+                    // Role processing
+                    if (claim.Type == config.RoleClaim)
                     {
-                        if (claim.Type == "realm_access") // This is specific to Keycloak. Don't use roles without Keycloak, I guess
+                        List<string> roles = JsonConvert.DeserializeObject<IDictionary<string, List<string>>>(claim.Value)["roles"]; // Might need error handling here
+                        foreach (string role in roles)
                         {
-                            List<string> roles = JsonConvert.DeserializeObject<IDictionary<string, List<string>>>(claim.Value)["roles"]; // Might need error handling here
-                            foreach (string validRoles in config.Roles)
+                            // Check if allowed to login based on roles
+                            if (config.Roles.Length != 0)
                             {
-                                foreach (string role in roles)
+                                foreach (string validRoles in config.Roles)
                                 {
                                     if (role.Equals(validRoles))
                                     {
@@ -95,17 +102,10 @@ public class SSOController : ControllerBase
                                     }
                                 }
                             }
-                        }
-                    }
-                    // Check if admin
-                    if (config.AdminRoles.Length != 0)
-                    {
-                        if (claim.Type == "realm_access") // This is specific to Keycloak. Don't use roles without Keycloak, I guess
-                        {
-                            List<string> roles = JsonConvert.DeserializeObject<IDictionary<string, List<string>>>(claim.Value)["roles"]; // Might need error handling here
-                            foreach (string validAdminRoles in config.AdminRoles)
+                            // Check if admin based on roles
+                            if (config.AdminRoles.Length != 0)
                             {
-                                foreach (string role in roles)
+                                foreach (string validAdminRoles in config.AdminRoles)
                                 {
                                     if (role.Equals(validAdminRoles))
                                     {
@@ -113,6 +113,17 @@ public class SSOController : ControllerBase
                                     }
                                 }
                             }
+                            // Get allowed folders from roles
+                            if (config.EnableFolderRoles)
+                            {
+                                foreach (FolderRoleMap folderRoleMap in config.FolderRoleMapping)
+                                {
+                                    if (role.Equals(folderRoleMap.Role))
+                                    {
+                                        StateManager[Request.Query["state"]].Folders.AddRange(folderRoleMap.Folders);
+                                    }
+                                }
+                            }
                         }
                     }
                 }
@@ -134,7 +145,7 @@ public class SSOController : ControllerBase
                 }
                 if (StateManager[Request.Query["state"]].Valid)
                 {
-                    return Content(WebResponse.OIDGenerator(data: Request.Query["state"], provider: provider, baseUrl: GetRequestBase()), MediaTypeNames.Text.Html);
+                    return Content(WebResponse.Generator(data: Request.Query["state"], provider: provider, baseUrl: GetRequestBase(), mode: "OID"), MediaTypeNames.Text.Html);
                 }
                 else
                 {
@@ -175,18 +186,18 @@ public class SSOController : ControllerBase
 
     [Authorize(Policy = "RequiresElevation")]
     [HttpPost("OID/Add")]
-    public void OIDAdd([FromBody] OIDConfig oidConfig)
+    public void OIDAdd([FromBody] OIDConfig config)
     {
         var configuration = SSOPlugin.Instance.Configuration;
         for (var i = 0; i < configuration.OIDConfigs.Count; i++)
         {
-            if (configuration.OIDConfigs[i].OIDClientId.Equals(oidConfig.OIDClientId))
+            if (configuration.OIDConfigs[i].OIDClientId.Equals(config.OIDClientId))
             {
                 configuration.OIDConfigs.RemoveAt(i);
             }
         }
 
-        configuration.OIDConfigs.Add(oidConfig);
+        configuration.OIDConfigs.Add(config);
         SSOPlugin.Instance.UpdateConfiguration(configuration);
     }
 
@@ -225,15 +236,15 @@ public class SSOController : ControllerBase
     [Produces(MediaTypeNames.Application.Json)]
     public async Task<ActionResult> OIDAuth([FromBody] AuthResponse response)
     {
-        foreach (var oidConfig in SSOPlugin.Instance.Configuration.OIDConfigs)
+        foreach (var config in SSOPlugin.Instance.Configuration.OIDConfigs)
         {
-            if (oidConfig.OIDClientId == response.Provider && oidConfig.Enabled)
+            if (config.OIDClientId == response.Provider && config.Enabled)
             {
                 foreach (var kvp in StateManager)
                 {
                     if (kvp.Value.State.State.Equals(response.Data) && kvp.Value.Valid)
                     {
-                        var authenticationResult = await Authenticate(kvp.Value.Username, kvp.Value.Admin, oidConfig.EnableAllFolders, oidConfig.EnabledFolders, response)
+                        var authenticationResult = await Authenticate(kvp.Value.Username, kvp.Value.Admin, config.EnableAuthorization, config.EnableAllFolders, kvp.Value.Folders.ToArray(), response)
                             .ConfigureAwait(false);
                         return Ok(authenticationResult);
                     }
@@ -248,26 +259,28 @@ public class SSOController : ControllerBase
     public ActionResult SAMLPost(string provider)
     {
         // I'm sure there's a better way than using nested for loops but eh whatever
-        foreach (var samlConfig in SSOPlugin.Instance.Configuration.SamlConfigs)
+        foreach (var config in SSOPlugin.Instance.Configuration.SamlConfigs)
         {
-            if (samlConfig.SamlClientId == provider && samlConfig.Enabled)
+            if (config.SamlClientId == provider && config.Enabled)
             {
-                var samlResponse = new Response(samlConfig.SamlCertificate, Request.Form["SAMLResponse"]);
-                if (samlConfig.Roles.Length == 0)
+                var samlResponse = new Response(config.SamlCertificate, Request.Form["SAMLResponse"]);
+                // If no roles are configured, don't use RBAC
+                if (config.Roles.Length == 0)
                 {
-                    return Content(WebResponse.SamlGenerator(xml: Convert.ToBase64String(System.Text.Encoding.UTF8.GetBytes(samlResponse.Xml)), provider: provider, baseUrl: GetRequestBase()), MediaTypeNames.Text.Html);
+                    return Content(WebResponse.Generator(data: Convert.ToBase64String(System.Text.Encoding.UTF8.GetBytes(samlResponse.Xml)), provider: provider, baseUrl: GetRequestBase(), mode: "SAML"), MediaTypeNames.Text.Html);
                 }
+                // Check if user is allowed to log in based on roles
                 foreach (string role in samlResponse.GetCustomAttributes("Role"))
                 {
-                    foreach (string allowedRole in samlConfig.Roles)
+                    foreach (string allowedRole in config.Roles)
                     {
                         if (allowedRole.Equals(role))
                         {
-                            return Content(WebResponse.SamlGenerator(xml: Convert.ToBase64String(System.Text.Encoding.UTF8.GetBytes(samlResponse.Xml)), provider: provider, baseUrl: GetRequestBase()), MediaTypeNames.Text.Html);
+                            return Content(WebResponse.Generator(data: Convert.ToBase64String(System.Text.Encoding.UTF8.GetBytes(samlResponse.Xml)), provider: provider, baseUrl: GetRequestBase(), mode: "SAML"), MediaTypeNames.Text.Html);
                         }
                     }
                 }
-                return Content("401 Forbidden");
+                return Content("401 Forbidden"); // TODO: Return error code as well
             }
         }
 
@@ -294,18 +307,18 @@ public class SSOController : ControllerBase
 
     [Authorize(Policy = "RequiresElevation")]
     [HttpPost("SAML/Add")]
-    public void SamlAdd([FromBody] SamlConfig samlConfig)
+    public void SamlAdd([FromBody] SamlConfig config)
     {
         var configuration = SSOPlugin.Instance.Configuration;
         for (var i = 0; i < configuration.SamlConfigs.Count; i++)
         {
-            if (configuration.SamlConfigs[i].SamlClientId.Equals(samlConfig.SamlClientId))
+            if (configuration.SamlConfigs[i].SamlClientId.Equals(config.SamlClientId))
             {
                 configuration.SamlConfigs.RemoveAt(i);
             }
         }
 
-        configuration.SamlConfigs.Add(samlConfig);
+        configuration.SamlConfigs.Add(config);
         SSOPlugin.Instance.UpdateConfiguration(configuration);
     }
 
@@ -337,23 +350,39 @@ public class SSOController : ControllerBase
     [Produces(MediaTypeNames.Application.Json)]
     public async Task<ActionResult> SamlAuth([FromBody] AuthResponse response)
     {
-        foreach (var samlConfig in SSOPlugin.Instance.Configuration.SamlConfigs)
+        foreach (var config in SSOPlugin.Instance.Configuration.SamlConfigs)
         {
-            if (samlConfig.SamlClientId == response.Provider && samlConfig.Enabled)
+            if (config.SamlClientId == response.Provider && config.Enabled)
             {
                 bool isAdmin = false;
-                var samlResponse = new Response(samlConfig.SamlCertificate, response.Data);
+                var samlResponse = new Response(config.SamlCertificate, response.Data);
+                List<string> folders;
+                if (!config.EnableFolderRoles)
+                {
+                    folders = new List<string>(config.EnabledFolders);
+                } else {
+                    folders = new List<string>();
+                }
                 foreach (string role in samlResponse.GetCustomAttributes("Role"))
                 {
-                    foreach (string allowedRole in samlConfig.AdminRoles)
+                    foreach (string allowedRole in config.AdminRoles)
                     {
                         if (allowedRole.Equals(role))
                         {
                             isAdmin = true;
                         }
                     }
+
+                    if (config.EnableFolderRoles) {
+                        foreach (FolderRoleMap folderRoleMap in config.FolderRoleMapping)
+                        {
+                            if (folderRoleMap.Role.Equals(role)) {
+                                folders.AddRange(folderRoleMap.Folders);
+                            }
+                        }
+                    }
                 }
-                var authenticationResult = await Authenticate(samlResponse.GetNameID(), isAdmin, samlConfig.EnableAllFolders, samlConfig.EnabledFolders, response)
+                var authenticationResult = await Authenticate(samlResponse.GetNameID(), isAdmin, config.EnableAuthorization, config.EnableAllFolders, folders.ToArray(), response)
                     .ConfigureAwait(false);
                 return Ok(authenticationResult);
             }
@@ -362,7 +391,17 @@ public class SSOController : ControllerBase
         return Problem("Something went wrong");
     }
 
-    private async Task<AuthenticationResult> Authenticate(string username, bool isAdmin, bool enableAllFolders, string[] enabledFolders, AuthResponse authResponse)
+    [Authorize(Policy = "RequiresElevation")]
+    [HttpPost("Unregister/{username}")]
+    public ActionResult Unregister(string username, [FromBody] string provider)
+    {
+        User user = _userManager.GetUserByName(username);
+        user.AuthenticationProviderId = provider;
+
+        return Ok();
+    }
+
+    private async Task<AuthenticationResult> Authenticate(string username, bool isAdmin, bool enableAuthorization, bool enableAllFolders, string[] enabledFolders, AuthResponse authResponse)
     {
         User user = null;
         user = _userManager.GetUserByName(username);
@@ -373,11 +412,13 @@ public class SSOController : ControllerBase
             user = await _userManager.CreateUserAsync(username).ConfigureAwait(false);
         }
         user.AuthenticationProviderId = GetType().FullName;
-        user.SetPermission(PermissionKind.IsAdministrator, isAdmin);
-        user.SetPermission(PermissionKind.EnableAllFolders, enableAllFolders);
-        if (!enableAllFolders)
-        {
-            user.SetPreference(PreferenceKind.EnabledFolders, enabledFolders);
+        if (enableAuthorization) {
+            user.SetPermission(PermissionKind.IsAdministrator, isAdmin);
+            user.SetPermission(PermissionKind.EnableAllFolders, enableAllFolders);
+            if (!enableAllFolders)
+            {
+                user.SetPreference(PreferenceKind.EnabledFolders, enabledFolders);
+            }
         }
 
         await _userManager.UpdateUserAsync(user).ConfigureAwait(false);
@@ -447,4 +488,6 @@ public class TimedAuthorizeState
     public bool Admin { get; set; }
 
     public string Email { get; set; }
+
+    public List<string> Folders { get; set; }
 }

SSO-Auth/Config/PluginConfiguration.cs

@@ -37,6 +37,8 @@ public class SamlConfig
 
     public bool Enabled { get; set; }
 
+    public bool EnableAuthorization { get; set; }
+
     public bool EnableAllFolders { get; set; }
 
     public string[] EnabledFolders { get; set; }
@@ -44,6 +46,12 @@ public class SamlConfig
     public string[] AdminRoles { get; set; }
 
     public string[] Roles { get; set; }
+
+    public bool EnableFolderRoles { get; set; }
+
+    [XmlArray("FolderRoleMappings")]
+    [XmlArrayItem(typeof(FolderRoleMap), ElementName = "FolderRoleMappings")]
+    public List<FolderRoleMap> FolderRoleMapping { get; set; }
 }
 
 [XmlRoot("PluginConfiguration")]
@@ -57,6 +65,8 @@ public class OIDConfig
 
     public bool Enabled { get; set; }
 
+    public bool EnableAuthorization { get; set; }
+
     public bool EnableAllFolders { get; set; }
 
     public string[] EnabledFolders { get; set; }
@@ -64,4 +74,19 @@ public class OIDConfig
     public string[] AdminRoles { get; set; }
 
     public string[] Roles { get; set; }
+
+    public bool EnableFolderRoles { get; set; }
+
+    [XmlArray("FolderRoleMappings")]
+    [XmlArrayItem(typeof(FolderRoleMap), ElementName = "FolderRoleMap")]
+    public List<FolderRoleMap> FolderRoleMapping { get; set; }
+
+    public string RoleClaim { get; set; }
+}
+
+public class FolderRoleMap
+{
+    public string Role { get; set; }
+
+    public List<string> Folders { get; set; }
 }

SSO-Auth/Config/configPage.html

@@ -7,97 +7,9 @@
     <div data-role="page" class="page type-interior pluginConfigurationPage esqConfigurationPage">
         <div data-role="content">
             <div class="content-primary">
-                <form class="esqConfigurationForm">
-                    <div class="verticalSection verticalSection-extrabottompadding">
-                        <div class="sectionTitleContainer flex align-items-center">
-                            <h2 class="sectionTitle">SSO Settings:</h2>
-                            <a is="emby-button" class="raised button-alt headerHelpButton" target="_blank" href="https://github.com/9p4/jellyfin-plugin-sso">${Help}</a>
-                        </div>
-                        <div class="verticalSection" is="emby-collapse" title="SSO Server Settings">
-                          <button id="newSaml" is="emby-button">
-                            <span>Add new SAML provider</span>
-                          </button>
-                          <button id="newOID" is="emby-button">
-                            <span>Add new OpenID provider</span>
-                          </button>
-                            <div class="collapseContent" id="default">
-                              <div class="samlProviderWrapper">
-                                <div class="samlProvider">
-                                <div class="inputContainer">
-                                  <input is="emby-input" type="text" id="txtSamlEndpoint" required placeholder="https://saml-provider.example.com/login" label="SAML Endpoint" />
-                                </div>
-                                <div class="inputContainer">
-                                  <input is="emby-input" type="text" id="txtSamlClientId" required placeholder="myjellyfin.example.com" label="SAML Client ID" />
-                                </div>
-                                <div class="inputContainer">
-                                  <textarea is="emby-textarea" id="txtSamlCertificate" placeholder="Base64-encoded realm certificate" label="SAML Certificate"></textarea>
-                                </div>
-                                <div class="checkboxContainer checkboxContainer-withDescription">
-                                  <label>
-                                    <input type="checkbox" is="emby-checkbox" id="chkSamlEnable" />
-                                    <span>Enable Provider</span>
-                                  </label>
-                                </div>
-                                </div>
-                              </div>
-
-                              <button id="btnSaveSettings" is="emby-button" type="submit" value="submit" class="raised button block">
-                                  <span>Update Provider</span>
-                              </button>
-                            </div>
-                        </div>
-                    </div>
-                </form>
+                <a href="https://github.com/9p4/jellyfin-plugin-sso/blob/main/README.md">Review the documentation. This plugin is configured via the API.</a>
             </div>
         </div>
-
-
-        <script type="text/javascript">
-            var SSOConfigurationPage = {
-                pluginUniqueId: "505ce9d1-d916-42fa-86ca-673ef241d7df",
-            };
-
-            document.querySelector('.esqConfigurationPage').addEventListener("pageshow", function () {
-                Dashboard.showLoadingMsg();
-
-                window.ApiClient.getPluginConfiguration(SSOConfigurationPage.pluginUniqueId).then(function (config) {
-                    SSOConfigurationPage.txtSamlEndpoint.value = config.SamlEndpoint;
-                    SSOConfigurationPage.txtSamlCertificate.value = config.SamlCertificate;
-                    SSOConfigurationPage.txtSamlClientId.value = config.SamlClientId;
-                    });
-
-                Dashboard.hideLoadingMsg();
-                });
-
-            var form = document.querySelector(".esqConfigurationForm");
-            form.addEventListener("submit", function(e){
-                e.preventDefault();
-                Dashboard.showLoadingMsg();
-
-                window.ApiClient.getPluginConfiguration(SSOConfigurationPage.pluginUniqueId).then(function (config) {
-                    config.SamlCertificate = SSOConfigurationPage.txtSamlCertificate.value;
-                    config.SamlEndpoint = SSOConfigurationPage.txtSamlEndpoint.value;
-                    config.SamlClientId = SSOConfigurationPage.txtSamlClientId.value;
-                    window.ApiClient.updatePluginConfiguration(SSOConfigurationPage.pluginUniqueId, config).then(Dashboard.processPluginConfigurationUpdateResult);
-                });
-
-                // Disable default form submission
-                return false;
-            });
-
-          var newSaml = document.getElementById("newSaml");
-          newSaml.addEventListener("click", function(e) {
-                      e.preventDefault();
-                      Dashboard.showLoadingMsg();
-                      fetch(window.ApiClient.getUrl("sso/SAML/Get?api_key=" + window.ApiClient.accessToken()))
-                      .then(response => {
-                           if (!response.ok) {
-                               throw new Error("HTTP error " + response.status);
-                           }
-                           return response.json();
-                       }).then(json => {console.log(json)});
-                    });
-        </script>
     </div>
 </body>
 </html>

SSO-Auth/SSO-Auth.csproj

@@ -3,8 +3,8 @@
   <PropertyGroup>
     <TargetFramework>net6.0</TargetFramework>
     <RootNamespace>Jellyfin.Plugin.SSO_Auth</RootNamespace>
-    <AssemblyVersion>2.0.1.0</AssemblyVersion>
-    <FileVersion>2.0.1.0</FileVersion>
+    <AssemblyVersion>3.1.0.1</AssemblyVersion>
+    <FileVersion>3.1.0.1</FileVersion>
     <GenerateDocumentationFile>true</GenerateDocumentationFile>
     <TreatWarningsAsErrors>false</TreatWarningsAsErrors>
   </PropertyGroup>

SSO-Auth/WebResponse.cs

@@ -3,7 +3,11 @@ namespace Jellyfin.Plugin.SSO_Auth;
 public static class WebResponse
 {
     public static readonly string Base = @"<!DOCTYPE html>
-<html><head></head><body><script>
+<html><head></head><body>
+<p>Logging in...</p>
+<noscript>Please enable Javascript to complete the login</noscript>
+<script>
+
 function isTv() {
     // This is going to be really difficult to get right
     const userAgent = navigator.userAgent.toLowerCase();
@@ -389,22 +393,32 @@ function getDeviceName() {
     return deviceName;
 }
 
+const sleep = (milliseconds) => {
+    return new Promise(resolve => setTimeout(resolve, milliseconds))
+}
+
 ";
 
-    public static string OIDGenerator(string data, string provider, string baseUrl)
+    public static string Generator(string data, string provider, string baseUrl, string mode)
     {
         return Base + @"
 async function main() {
     var data = '" + data + @"';
+    while (localStorage.getItem(""_deviceId2"") == null ||
+        localStorage.getItem(""jellyfin_credentials"") == null ||
+        JSON.parse(localStorage.getItem(""jellyfin_credentials""))['Servers'][0]['Id'] == null) {
+        // If localStorage isn't initialized yet, try again.
+        await sleep(100);
+    }
     var deviceId = localStorage.getItem(""_deviceId2"");
     var appName = ""Jellyfin Web"";
     var appVersion = ""10.8.0"";
     var deviceName = getDeviceName();
     var provider = '" + provider + @"';
 
-    var request = {'deviceID': deviceId, 'appName': appName, 'appVersion': appVersion, deviceName: 'deviceName', data: data, provider: '" + provider + @"'};
+    var request = {deviceId, appName, appVersion, deviceName, data, provider: '" + provider + @"'};
 
-    var url = '" + baseUrl + @"/sso/OID/Auth';
+    var url = '" + baseUrl + "/sso/" + mode + @"/Auth';
 
     let response = await new Promise(resolve => {
        var xhr = new XMLHttpRequest();
@@ -428,60 +442,14 @@ async function main() {
     jfCreds['Servers'][0]['UserId'] = responseJson['User']['Id'];
     localStorage.setItem('jellyfin_credentials', JSON.stringify(jfCreds));
     localStorage.setItem('enableAutoLogin', 'true');
-    window.location.replace('/');
+    window.location.replace('" + baseUrl + @"');
 }
 
 document.addEventListener('DOMContentLoaded', function () {
     main();
 });
 
-</script></body></html>";
-    }
-
-    public static string SamlGenerator(string xml, string provider, string baseUrl)
-    {
-        return Base + @"
-async function main() {
-    var xml = '" + xml + @"';
-    var deviceId = localStorage.getItem(""_deviceId2"");
-    var appName = ""Jellyfin Web"";
-    var appVersion = ""10.8.0"";
-    var deviceName = getDeviceName();
-    var provider = '" + provider + @"';
-
-    var request = {'deviceID': deviceId, 'appName': appName, 'appVersion': appVersion, deviceName: 'deviceName', data: xml, provider: '" + provider + @"'};
-
-    var url = '" + baseUrl + @"/sso/SAML/Auth';
-
-    let response = await new Promise(resolve => {
-       var xhr = new XMLHttpRequest();
-       xhr.open('POST', url, true);
-       xhr.setRequestHeader('Content-Type', 'application/json');
-       xhr.setRequestHeader('Accept', 'application/json');
-       xhr.onload = function(e) {
-         resolve(xhr.response);
-       };
-       xhr.onerror = function () {
-         resolve(undefined);
-       };
-       xhr.send(JSON.stringify(request));
-    })
-    var responseJson = JSON.parse(response);
-    var userId = 'user-' + responseJson['User']['Id'] + '-' + responseJson['User']['ServerId'];
-    responseJson['User']['EnableAutoLogin'] = true;
-    localStorage.setItem(userId, JSON.stringify(responseJson['User']));
-    var jfCreds = JSON.parse(localStorage.getItem('jellyfin_credentials'));
-    jfCreds['Servers'][0]['AccessToken'] = responseJson['AccessToken'];
-    jfCreds['Servers'][0]['UserId'] = responseJson['User']['Id'];
-    localStorage.setItem('jellyfin_credentials', JSON.stringify(jfCreds));
-    localStorage.setItem('enableAutoLogin', 'true');
-    window.location.replace('/');
-}
-
-document.addEventListener('DOMContentLoaded', function () {
-    main();
-});
-
-</script></body></html>";
+// https://stackoverflow.com/a/25435165
+</script><iframe class='docs-texteventtarget-iframe' sandbox='allow-same-origin allow-forms allow-scripts' src='" + baseUrl + "' style='position: absolute;width:0;height:0;border:0;'></iframe></body></html>";
     }
 }

build.yaml

@@ -1,7 +1,7 @@
 name: "SSO Authentication"
 guid: "505ce9d1-d916-42fa-86ca-673ef241d7df"
 imageUrl: "https://raw.githubusercontent.com/9p4/jellyfin-plugin-sso/main/img/logo.png"
-version: "2.0.1.0"
+version: "3.1.0.1"
 targetAbi: "10.8.0.0"
 framework: "net6.0"
 owner: "9p4"
@@ -15,6 +15,9 @@ artifacts:
   - "IdentityModel.OidcClient.dll"
   - "IdentityModel.dll"
 changelog: |
+  3.1.0.1: Fix redirect bug in WebResponse (#7)
+  3.1.0.0: Simplify auth flow so loading the web UI is not required
+  3.0.0.0: Add more RBAC features and option to unregister user from SSO
   2.0.1.0: Fix improper artifact loading
   2.0.0.0: Add RBAC and Google support
   1.0.0.0: Initial Release