OIDC Settings:

${Help}

Note: Making changes to this configuration may require a restart of Jellyfin.

See the help page for more information.
To allow users to manage their own OIDC accounts, including linking OIDC providers, and removing existing links, they need to visit the self service page .
You can use custom menu links to accomplish this.

The name used by Jellyfin to identify the OpenID provider.
If an OpenID provider with a matching name does not exist, a new provider with this name will be created.
If an OpenID provider with a matching name already exists, the settings for that provider will be updated.
This is the callback URL to give to your OIDC server
This is the link to initiate the OIDC Login.
The OpenID endpoint. Must have a .well-known path available.
The OpenID client ID, for this media server instance. This is configured on the OIDC provider to uniquely identify this Jellyfin instance.
The OpenID client secret.
Determines if the plugin sets permissions for the user.
If false, the user will start with no permissions and an administrator will add permissions.
The permissions of existing users will not be rewritten on subsequent logins.
If a user has this role, then the user is authenticated. This validates the OpenID response against the claim set in "Role Claim".
Leave blank to disable role checking.
Like "User Role", but having this role confers admin privilege.
Leave blank to not set admin privileges.
This is the value in the OpenID response to check for roles. The first element is the claim type, the subsequent values are to parse the JSON of the claim value. Use a "\." to denote a literal ".". This expects a list of strings from the OIDC server.
For Keycloak, it is realm_access.roles by default for realm roles. For client roles, it is resource_access.>clientId<.roles (e.g. resource_access.jellyfin.roles)
For Authelia, it is groups
Specify additional scopes to include in the OIDC request.
One scope per line, each line should contain a scope name to include in the OIDC request.
For some OIDC providers (For example, authelia), additional scopes may be required in order to validate group membership in role claim.
Leave blank to only request the default scopes.
The set provider then gets assigned to the user after they have logged in. If it is not set, nothing is changed. With this, a user can login with OIDC but is still able to log in via other providers later.
Default is Jellyfin.Server.Implementations.Users.DefaultAuthenticationProvider for the default provider.
The default username claim to use from OpenID by default. If it is not set, it defaults to preferred_username.
The claim prefix to use from OpenID to apply user Policy and Configuration. All claims matching the prefix will be sorted by name and then merged, the first item wins. Leave empty to not apply any Policy or Configuration.
Default: jellyfin-. for example
  1. jellyfin-2
  2. jellyfin-10
  3. jellyfin-0
  4. jellyfin-1
will be sorted to
  1. jellyfin-0
  2. jellyfin-1
  3. jellyfin-10
  4. jellyfin-2
and jellyfin-0 will take priority.

Use this select box to show the effective config for a user:
0
Specify additional claims to use from OpenID to apply user Policy and Configuration.
Data Claim Prefix takes priority.
Leave empty to not apply any Policy or Configuration.
The claim to get the url for the users avatar from
Disable for Google OAuth
Time in minutes to wait for an authentication to complete
May be required for Cloudflare OpenID
If the plugin is redirecting to an incorrect port, set this to the appropiate port