Jellyfin

Tested Versions

• Authelia
  • v4.38.17
• Jellyfin
  • v10.10.6

{{% oidc-common %}}

Assumptions

This example makes the following assumptions:

• Application Root URL: https://jellyfin.{{< sitevar name="domain" nojs="example.com" >}}/
• Authelia Root URL: https://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}/
• Client ID: jellyfin
• Client Secret: insecure_secret

Some of the values presented in this guide can automatically be replaced with documentation variables.

{{< sitevar-preferences >}}

Configuration

The following example uses the Jellyfin SSO Plugin which is assumed to be installed when following this section of the guide.

To install the Jellyfin SSO Plugin for Jellyfin via the Web GUI:

1. Visit the Jellyfin Administration Dashboard.
2. Visit the Plugins section.
3. Visit the Repositories tab.
4. Click the + to add a repository.
5. Enter the following details:
   • Repository Name: Jellyfin SSO
   • Repository URL: https://raw.githubusercontent.com/9p4/jellyfin-plugin-sso/manifest-release/manifest.json
6. Click Save.
7. Click Ok to confirm the repository installation.

Authelia

The following YAML configuration is an example Authelia client configuration for use with Jellyfin which will operate with the application example:

identity_providers:
  oidc:
    ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
    ## See: https://www.authelia.com/c/oidc
    clients:
      - client_id: 'jellyfin'
        client_name: 'Jellyfin'
        client_secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
        public: false
        authorization_policy: 'two_factor'
        require_pkce: true
        pkce_challenge_method: 'S256'
        redirect_uris:
          - 'https://jellyfin.{{< sitevar name="domain" nojs="example.com" >}}/sso/OID/redirect/authelia'
        scopes:
          - 'openid'
          - 'profile'
          - 'groups'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_post'

Application

{{< callout context="caution" title="Important Note" icon="outline/alert-triangle" >}} This configuration assumes Jellyfin administrators are part of the jellyfin-admins group, and Jellyfin users are part of the jellyfin-users group. Depending on your specific group configuration, you will have to adapt the AdminRoles and Roles nodes respectively. Alternatively you may elect to create a new authorization policy in provider authorization policies then utilize that policy as the client authorization policy. {{< /callout >}}

To configure Jellyfin there are two methods, using the Configuration File, or using the Web GUI.

However the following steps must be completed via the UI first regardless of which option you choose:

1. Visit the Catalog tab.
2. Select SSO Authentication from the Authentication section.
3. Click Install.
4. Click Ok to confirm the plugin installation.
5. Once installed restart Jellyfin.

Configuration File

{{< callout context="tip" title="Did you know?" icon="outline/rocket" >}} Generally the configuration file is named SSO-Auth.xml. {{< /callout >}}

To configure Jellyfin to utilize Authelia as an OpenID Connect 1.0 Provider, use the following configuration:

<?xml version="1.0" encoding="utf-8"?>
<PluginConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
  <SamlConfigs />
  <OidConfigs>
    <item>
      <key>
        <string>authelia</string>
      </key>
      <value>
        <PluginConfiguration>
          <OidEndpoint>https://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}</OidEndpoint>
          <OidClientId>jellyfin</OidClientId>
          <OidSecret>insecure_secret</OidSecret>
          <Enabled>true</Enabled>
          <EnableAuthorization>true</EnableAuthorization>
          <EnableAllFolders>true</EnableAllFolders>
          <EnabledFolders />
          <AdminRoles>
            <string>jellyfin-admins</string>
          </AdminRoles>
          <Roles>
            <string>jellyfin-users</string>
            <string>jellyfin-admins</string>
          </Roles>
          <EnableFolderRoles>false</EnableFolderRoles>
          <EnableLiveTvRoles>false</EnableLiveTvRoles>
          <EnableLiveTv>false</EnableLiveTv>
          <EnableLiveTvManagement>false</EnableLiveTvManagement>
          <LiveTvRoles />
          <LiveTvManagementRoles />
          <FolderRoleMappings />
          <RoleClaim>groups</RoleClaim>
          <OidScopes>
            <string>groups</string>
          </OidScopes>
          <CanonicalLinks></CanonicalLinks>
          <DisableHttps>false</DisableHttps>
          <DoNotValidateEndpoints>false</DoNotValidateEndpoints>
          <DoNotValidateIssuerName>false</DoNotValidateIssuerName>
        </PluginConfiguration>
      </value>
    </item>
  </OidConfigs>
</PluginConfiguration>

Web GUI

To configure Jellyfin to utilize Authelia as an OpenID Connect 1.0 Provider, use the following instructions:

1. Visit the Jellyfin Administration Dashboard.
2. Visit the Plugins section.
3. Click the SSO-Auth plugin.
4. Add a provider.
5. Configure the following options:
   • Name of the OID Provider: authelia
   • OID Endpoint: https://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}
   • OpenID Client ID: jellyfin
   • OID Secret: insecure_secret
   • Enabled: Checked
   • Enable Authorization by Plugin: Checked
   • Enable All Folders: Checked
   • Roles: jellyfin-users, jellyfin-admins
   • Admin Roles: jellyfin-admins
   • Role Claim: groups
   • Request Additional Scopes: groups
   • Set default username claim: preferred_username
6. All other options may remain unchecked or unconfigured.
7. Click Save.
8. To log in visit https://jellyfin.{{< sitevar name="domain" nojs="example.com" >}}/sso/OID/start/authelia.
9. Follow the Jellyfin SSO Plugin documentation on how to create a button on the Jellyfin login page.

See Also

• Jellyfin SSO Plugin Repository