ContextQMD
Back to Authelia

Jellyfin

docs/content/integration/openid-connect/clients/jellyfin/index.md

4.39.207.7 KB
Original Source

Tested Versions

{{% oidc-common %}}

Assumptions

This example makes the following assumptions:

  • Application Root URL: https://jellyfin.{{< sitevar name="domain" nojs="example.com" >}}/
  • Authelia Root URL: https://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}/
  • Client ID: jellyfin
  • Client Secret: insecure_secret

Some of the values presented in this guide can automatically be replaced with documentation variables.

{{< sitevar-preferences >}}

Configuration

The following example uses the Jellyfin SSO-Auth Plugin which is assumed to be installed when following this section of the guide.

To install the Jellyfin SSO-Auth Plugin for Jellyfin via the Web GUI:

  1. Visit the Jellyfin Administration Dashboard.
  2. Visit the Plugins section.
  3. Visit the Repositories tab.
  4. Click the + to add a repository.
  5. Enter the following details:
    • Repository Name: Jellyfin SSO-Auth
    • Repository URL: https://raw.githubusercontent.com/9p4/jellyfin-plugin-sso/manifest-release/manifest.json
  6. Click Save.
  7. Click Ok to confirm the repository installation.

Authelia

The following YAML configuration is an example Authelia client configuration for use with Jellyfin which will operate with the application example:

yaml
identity_providers:
  oidc:
    ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
    ## See: https://www.authelia.com/c/oidc
    clients:
      - client_id: 'jellyfin'
        client_name: 'Jellyfin'
        client_secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
        public: false
        authorization_policy: 'two_factor'
        require_pkce: true
        pkce_challenge_method: 'S256'
        redirect_uris:
          - 'https://jellyfin.{{< sitevar name="domain" nojs="example.com" >}}/sso/OID/redirect/authelia'
        scopes:
          - 'openid'
          - 'profile'
          - 'groups'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_post'

Application

{{< callout context="caution" title="Important Note" icon="outline/alert-triangle" >}} This configuration assumes Jellyfin administrators are part of the jellyfin-admins group, and Jellyfin users are part of the jellyfin-users group. Depending on your specific group configuration, you will have to adapt the AdminRoles and Roles nodes respectively. Alternatively you may elect to create a new authorization policy in provider authorization policies then utilize that policy as the client authorization policy. {{< /callout >}}

To configure the Jellyfin SSO-Auth Plugin there are two methods, using the Configuration File, or using the Web GUI.

However the following steps must be completed via the UI first regardless of which option you choose:

  1. Visit the Jellyfin Administration Dashboard.
  2. Visit the Plugins section.
  3. Select All plugins and the Other Category, find SSO-Auth and select it.
  4. Click Install.
  5. Click Ok to confirm the plugin installation.
  6. Once installed restart Jellyfin.

Configuration File

{{< callout context="tip" title="Did you know?" icon="outline/rocket" >}} Generally the configuration file is named SSO-Auth.xml. {{< /callout >}}

To configure the Jellyfin SSO-Auth Plugin to utilize Authelia as an OpenID Connect 1.0 Provider, use the following configuration:

xml
<?xml version="1.0" encoding="utf-8"?>
<PluginConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
  <SamlConfigs />
  <OidConfigs>
    <item>
      <key>
        <string>authelia</string>
      </key>
      <value>
        <PluginConfiguration>
          <OidEndpoint>https://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}</OidEndpoint>
          <OidClientId>jellyfin</OidClientId>
          <OidSecret>insecure_secret</OidSecret>
          <Enabled>true</Enabled>
          <EnableAuthorization>true</EnableAuthorization>
          <EnableAllFolders>true</EnableAllFolders>
          <EnabledFolders />
          <AdminRoles>
            <string>jellyfin-admins</string>
          </AdminRoles>
          <Roles>
            <string>jellyfin-users</string>
            <string>jellyfin-admins</string>
          </Roles>
          <EnableFolderRoles>false</EnableFolderRoles>
          <EnableLiveTvRoles>false</EnableLiveTvRoles>
          <EnableLiveTv>false</EnableLiveTv>
          <EnableLiveTvManagement>false</EnableLiveTvManagement>
          <LiveTvRoles />
          <LiveTvManagementRoles />
          <FolderRoleMappings />
          <RoleClaim>groups</RoleClaim>
          <OidScopes>
            <string>groups</string>
          </OidScopes>
          <CanonicalLinks></CanonicalLinks>
          <DisableHttps>false</DisableHttps>
          <DoNotValidateEndpoints>false</DoNotValidateEndpoints>
          <DoNotValidateIssuerName>false</DoNotValidateIssuerName>
          <SchemeOverride>https</SchemeOverride>
        </PluginConfiguration>
      </value>
    </item>
  </OidConfigs>
</PluginConfiguration>

Web GUI

To configure the Jellyfin SSO-Auth Plugin to utilize Authelia as an OpenID Connect 1.0 Provider via the Web GUI, use the following instructions:

  1. Visit the Jellyfin Administration Dashboard.
  2. Visit the Plugins section.
  3. Click the SSO-Auth plugin.
  4. Click ⚙ Settings button.
  5. Add a provider.
  6. Configure the following options:
    • Name of the OID Provider: authelia
    • OID Endpoint: https://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}
    • OpenID Client ID: jellyfin
    • OID Secret: insecure_secret
    • Enabled: Checked
    • Enable Authorization by Plugin: Checked
    • Enable All Folders: Checked
    • Roles: jellyfin-users, jellyfin-admins
    • Admin Roles: jellyfin-admins
    • Role Claim: groups
    • Request Additional Scopes: groups
    • Set default username claim: preferred_username
    • Scheme Override: https
  7. All other options may remain unchecked or unconfigured.
  8. Click Save.
  9. To log in, visit https://jellyfin.{{< sitevar name="domain" nojs="example.com" >}}/sso/OID/start/authelia.
  10. Follow the Jellyfin SSO-Auth Plugin documentation on how to create a button on the Jellyfin login page.

Add a Login Button to Jellyfin

The Jellyfin SSO-Auth Plugin has example instructions in the README

See Also