This plugin allows users to sign in through an SSO provider (such as Google, Microsoft, or your own provider). This enables one-click signin.
This plugin allows users to sign in through an SSO provider (such as Google, Microsoft, or your own provider). This enables one-click signin.
Project archived because I'm tired of working on this after all the years.
This plugin allows users to sign in through an SSO provider (such as Google, Microsoft, or your own provider). This enables one-click signin.
Existing users may link new SSO accounts, or remove existing links using self-service at /SSOViews/linking.
This is 100% alpha software! PRs are welcome to improve the code.
There is NO admin configuration! You must use the API to configure the program! Added by strazto in PR #18 and #27.
This is for Jellyfin >=10.8 and only on the Web UI or clients supporting Quick Connect
This README reflects the branch it is currently on! Switch tags to view version-specific documentation!
Find provider specific documentation in providers.md
This is my first time writing C# so please take all of the code written here with a grain of salt. This program should be reasonably secure since it validates all information passed from the client with either a certificate or a secret internal state.
Add the package repo https://raw.githubusercontent.com/9p4/jellyfin-plugin-sso/manifest-release/manifest.json to your Jellyfin plugin repositories.
Then, install the plugin from the plugin catalog!
See Contributing for instructions on how to build from source.
We have transitioned to a release system that automates distribution, packaging & hosting. This system is new, and if something goes wrong, you can try using the old package repository as a fallback.
Instead add the old package repository: https://repo.ersei.net/jellyfin/manifest.json to your jellyfin plugin repositories.
If you're impatient/brave/feel like helping us test things out, you can install the nightly build of the plugin, which is automatically built against the main branch.
The nightly build can be installed from the main plugin repo, and will always have a version number of 0.0.0.9000.
The nightly build may have new features unavailable in other builds, but be warned, things may change frequently in nightly builds, and things may break, and you could lose data.
In the Jellyfin administration UI, under "General", there is a "Branding" section. In that section, add the following code in the "Login disclaimer" block (replacing PROVIDER_NAME and the domain):
<form action="https://jellyfin.example.com/sso/OID/start/PROVIDER_NAME">
<button class="raised block emby-button button-submit">
Sign in with SSO
</button>
</form>Then, add the following code in the "Custom CSS code" section:
a.raised.emby-button {
padding: 0.9em 1em;
color: inherit !important;
}
.disclaimerContainer {
display: block;
}For more information, refer to issue #16.
Example for adding a SAML configuration with the API using curl:
curl -v -X POST -H "Content-Type: application/json" -d '{"samlEndpoint": "https://keycloak.example.com/realms/test/protocol/saml", "samlClientId": "jellyfin-saml", "samlCertificate": "Very long base64 encoded string here", "enabled": true, "enableAuthorization": true, "enableAllFolders": false, "enabledFolders": [], "adminRoles": ["jellyfin-admin"], "roles": ["allowed-to-use-jellyfin"], "enableFolderRoles": true, "folderRoleMapping": [{"role": "allowed-to-watch-movies", "folders": ["cc7df17e2f3509a4b5fc1d1ff0a6c4d0", "f137a2dd21bbc1b99aa5c0f6bf02a805"]}]}' "https://myjellyfin.example.com/sso/SAML/Add/PROVIDER_NAME?api_key=API_KEY_HERE"
Make sure that the JSON is the same as the configuration you would like.
The SAML provider must have the following configuration (I am using Keycloak, and I cannot speak for whatever you will see):
Make sure that clientid is replaced with the actual client ID and PROVIDER_NAME is replaced with the chosen provider name!
Example for adding an OpenID configuration with the API using curl
curl -v -X POST -H "Content-Type: application/json" -d '{"oidEndpoint": "https://keycloak.example.com/realms/test", "oidClientId": "jellyfin-oid", "oidSecret": "short secret here", "enabled": true, "enableAuthorization": true, "enableAllFolders": false, "enabledFolders": [], "adminRoles": ["jellyfin-admin"], "roles": ["allowed-to-use-jellyfin"], "enableFolderRoles": true, "folderRoleMapping": [{"role": "allowed-to-watch-movies", "folders": ["cc7df17e2f3509a4b5fc1d1ff0a6c4d0", "f137a2dd21bbc1b99aa5c0f6bf02a805"]}], "roleClaim": "realm_access", "oidScopes" : [""]}' "https://myjellyfin.example.com/sso/OID/Add/PROVIDER_NAME?api_key=API_KEY_HERE"
The OpenID provider must have the following configuration (again, I am using Keycloak)
Make sure that clientid is replaced with the actual client ID and PROVIDER_NAME is replaced with the chosen provider name!
The API is all done from a base URL of /sso/
SAML/start/PROVIDER_NAME: This is the SAML POST endpoint. It accepts a form response from the SAML provider and returns HTML and JavaScript for the client to login with a given provider name.SAML/start/PROVIDER_NAME: This is the SAML initiator: it will begin the authorization flow for SAML with a given provider name.SAML/Auth/PROVIDER_NAME: This is the SAML client-side API: the HTML and JavaScript client will call this endpoint to receive Jellyfin credentials given a provider name. Post format is in JSON with the following keys:deviceId: string. Device ID.deviceName: string. Device name.appName: string. App name.appVersion: string. App version.data: string. The signed SAML XML request. Used to verify a request.These all require authorization. Append an API key to the end of the request: curl "http://myjellyfin.example.com/sso/SAML/Get?api_key=API_KEY_HERE"
SAML/Add/PROVIDER_NAME: This adds or overwrites a configuration for SAML for the given provider name. It accepts JSON with the following keys and format:samlEndpoint: string. The SAML endpoint.samlClientId: string. The SAML client ID.samlCertificate: string. The base64 encoded SAML certificate.enabled: boolean. Determines if the provider is enabled or not.enableAuthorization: boolean: Determines if the plugin sets permissions for the user. If false, the user will start with no permissions and an administrator will add permissions. If disabled, then the permissions of users will not be modified and the Jellyfin defaults will be used instead.enableAllFolders: boolean. Determines if the client logging in is allowed access to all folders.enabledFolders: array of strings. If enableAllFolders is set to false, then this will be used to determine what folders the users who log in through this provider are allowed to use.roles: array of strings. This validates the SAML response against the Role attribute. If a user has any of these roles, then the user is authenticated. Leave blank to disable role checking.adminRoles: array of strings. This uses SAML response's Role attributes. If a user has any of these roles, then the user is an admin. Leave blank to disable (default is to not enable admin permissions).enableFolderRoles: boolean. Determines if role-based folder access should be used.folderRoleMapping: object in the format "role": string and "folders": array of strings. The user with this role will have access to the following folders if enableFolderRoles is enabled. To get the IDs of the folders, GET the /Library/MediaFolders URL with an API key. Look for the Id attribute.enableLiveTvRoles: boolean. Determines if role-based Live TV access should be used.liveTvRoles: array of strings. If enableLiveTvRoles is enabled, then the user's roles will be checked against these. If the user is granted permission, then the user will be able to view Live TV.liveTvManagementRoles: array of strings. If enableLiveTvRoles is enabled, then the user's roles will be checked against these. If the user is granted permission, then the user will be able to manage Live TV.enableLiveTv: boolean. Whether to allow Live TV by default. This applies even if enableLiveTvRoles is enabled.enableLiveTvManagement: boolean. Whether to allow Live TV management by default. This applies even if enableLiveTvRoles is enabled.defaultProvider: string. The set provider then gets assigned to the user after they have logged in. If it is not set, nothing is changed. With this, a user can login with SSO but is still able to log in via other providers later. See the Unregister endpoint.schemeOverride: string. Sets the scheme for URLs used. Can be useful if the plugin refuses to use HTTPS URLs.SAML/Del/PROVIDER_NAME: This removes a configuration for SAML for a given provider name.SAML/Get: Lists the configurations currently available.OID/redirect/PROVIDER_NAME: This is the OpenID callback path. This will return HTML and JavaScript for the client to login with a given provider name.OID/start/PROVIDER_NAME: This is the OpenID initiator: it will begin the authorization flow for OpenID with a given provider name.OID/Auth/PROVIDER_NAME: This is the OpenID client-side API: the HTML and JavaScript client will call this endpoint to receive Jellyfin credentials for a given provider name. Post foNo open issues yet, or sync has not completed.