authelia/docs/content/integration/openid-connect/jellyfin/index.md

title	description	summary	date	draft	images	weight	toc	support	seo
Jellyfin	Integrating Jellyfin with the Authelia OpenID Connect 1.0 Provider.		2024-04-12T21:54:41+10:00	false		620	true	level versions integration community true true	title description canonical noindex false

Tested Versions

• Authelia
  • v4.38.6
• Jellyfin
  • 10.8.13

{{% oidc-common %}}

Assumptions

This example makes the following assumptions:

• Application Root URL: https://jellyfin.{{< sitevar name="domain" nojs="example.com" >}}/
• Authelia Root URL: https://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}/
• Client ID: jellyfin
• Client Secret: insecure_secret

Some of the values presented in this guide can automatically be replaced with documentation variables.

{{< sitevar-preferences >}}

Configuration

Authelia

The following YAML configuration is an example Authelia client configuration for use with Jellyfin which will operate with the application example:

identity_providers:
  oidc:
    ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
    ## See: https://www.authelia.com/c/oidc
    clients:
      - client_id: 'jellyfin'
        client_name: 'Jellyfin'
        client_secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
        public: false
        authorization_policy: 'two_factor'
        require_pkce: true
        pkce_challenge_method: 'S256'
        redirect_uris:
          - 'https://jellyfin.{{< sitevar name="domain" nojs="example.com" >}}/sso/OID/redirect/authelia'
        scopes:
          - 'openid'
          - 'profile'
          - 'groups'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_post'

Application

{{< callout context="caution" title="Important Note" icon="outline/alert-triangle" >}} This configuration assumes Jellyfin administrators are part of the jellyfin-admins group, and Jellyfin users are part of the jellyfin-users group. Depending on your specific group configuration, you will have to adapt the AdminRoles and Roles nodes respectively. Alternatively you may elect to create a new authorization policy in provider authorization policies then utilize that policy as the client authorization policy. {{< /callout >}}

To configure Jellyfin to utilize Authelia as an OpenID Connect 1.0 Provider:

1. Visit the Jellyfin Administration Dashboard.

2. Visit the Plugins section.

3. Visit the Repositories tab.

4. Click the + to add a repository.

5. Enter the following details:

   1. Repository Name: Jellyfin SSO
   2. Repository URL: https://raw.githubusercontent.com/9p4/jellyfin-plugin-sso/manifest-release/manifest.json

6. Click Save.

7. Click Ok to confirm the repository installation.

8. Visit the Catalog tab.

9. Select SSO Authentication from the Authentication section.

10. Click Install.

11. Click Ok to confirm the plugin installation.

12. Once installed restart Jellyfin.

13. Complete steps 1 and 2 again.

14. Click the SSO-Auth plugin.

15. Add a provider with the following settings:

    1. Name of the OID Provider: Authelia

    2. OID Endpoint: https://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}

    3. OpenID Client ID: jellyfin

    4. OID Secret: insecure_secret

    5. Enabled: Checked

    6. Enable Authorization by Plugin: Checked

    7. Enable All Folders: Checked

    8. Roles: jellyfin-users

    9. Admin Roles: jellyfin-admins

    10. Role Claim: groups

    11. Request Additional Scopes: groups

    12. Set default username claim: preferred_username

16. All other options may remain unchecked or unconfigured.

17. Click Save.

Alternatively you can utilize the following configuration XML:

<?xml version="1.0" encoding="utf-8"?>
<PluginConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
  <SamlConfigs />
  <OidConfigs>
    <item>
      <key>
        <string>authelia</string>
      </key>
      <value>
        <PluginConfiguration>
          <OidEndpoint>https://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}</OidEndpoint>
          <OidClientId>jellyfin</OidClientId>
          <OidSecret>insecure_secret</OidSecret>
          <Enabled>true</Enabled>
          <EnableAuthorization>true</EnableAuthorization>
          <EnableAllFolders>true</EnableAllFolders>
          <EnabledFolders />
          <AdminRoles>
            <string>admins</string>
          </AdminRoles>
          <Roles>
            <string>users</string>
          </Roles>
          <EnableFolderRoles>false</EnableFolderRoles>
          <EnableLiveTvRoles>false</EnableLiveTvRoles>
          <EnableLiveTv>false</EnableLiveTv>
          <EnableLiveTvManagement>false</EnableLiveTvManagement>
          <LiveTvRoles />
          <LiveTvManagementRoles />
          <FolderRoleMappings />
          <RoleClaim>groups</RoleClaim>
          <OidScopes>
            <string>groups</string>
          </OidScopes>
          <CanonicalLinks></CanonicalLinks>
          <DisableHttps>false</DisableHttps>
          <DoNotValidateEndpoints>false</DoNotValidateEndpoints>
          <DoNotValidateIssuerName>false</DoNotValidateIssuerName>
        </PluginConfiguration>
      </value>
    </item>
  </OidConfigs>
</PluginConfiguration>

See Also

• Jellyfin SSO Plugin Repository