519 lines
28 KiB
HTML
519 lines
28 KiB
HTML
<!doctype html>
|
|
<html lang="en">
|
|
|
|
<head>
|
|
<title>OIDC</title>
|
|
</head>
|
|
|
|
<body>
|
|
<div
|
|
class="page type-interior pluginConfigurationPage esqConfigurationPage"
|
|
data-controller="__plugin/OIDC-Auth-config.js"
|
|
data-role="page"
|
|
id="oidc-config-page">
|
|
<div data-role="content">
|
|
<div class="content-primary">
|
|
<div class="sectionTitleContainer flex align-items-center">
|
|
<h2 class="sectionTitle">OIDC Settings:</h2>
|
|
<a
|
|
class="raised button-alt headerHelpButton"
|
|
href="https://gitea.narnian.us/lordwelch/jellyfin-plugin-sso"
|
|
is="emby-button"
|
|
target="_blank">${Help}</a>
|
|
</div>
|
|
<p>
|
|
<i>Note:</i>
|
|
Making changes to this configuration may require a restart of Jellyfin.
|
|
<br />
|
|
<br />
|
|
See the
|
|
<a
|
|
class="button-link"
|
|
href="https://gitea.narnian.us/lordwelch/jellyfin-plugin-sso"
|
|
target="_blank"
|
|
is="emby-linkbutton">help page</a>
|
|
for more information.
|
|
<br />
|
|
<!-- TODO: do not allow removing the last link -->
|
|
To allow users to manage their own OIDC accounts, including linking
|
|
OIDC providers, and removing existing links, they need to visit
|
|
<a href="#top"
|
|
class="button-link"
|
|
id="oidc-self-service-link"
|
|
target="_blank"
|
|
is="emby-linkbutton">the self service page </a>. <br />
|
|
<!-- TODO: use Plugin Pages to add this by default -->
|
|
You can use
|
|
<a
|
|
class="button-link"
|
|
href="https://jellyfin.org/docs/general/clients/web-config.html#custom-menu-links"
|
|
target="_blank"
|
|
is="emby-linkbutton">custom menu links
|
|
</a>
|
|
to accomplish this.
|
|
</p>
|
|
|
|
<form class="esqConfigurationForm" id="oidc-load-config">
|
|
<div class="headerTabs sectionTabs">
|
|
<div is="emby-tabs" data-index="0" class="tabs-viewmenubar emby-tabs focusable scrollX" data-scroll-mode-x="custom">
|
|
<div id="oidc-tab-insert" class="emby-tabs-slider" style="white-space:nowrap;">
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div
|
|
class="verticalSection"
|
|
is="emby-collapse"
|
|
title="Add a new Provider">
|
|
<div class="collapseContent">
|
|
<button
|
|
class="raised button-submit block emby-button"
|
|
id="NewProvider"
|
|
is="emby-button"
|
|
type="button">
|
|
<span>New Provider</span>
|
|
</button>
|
|
</div>
|
|
</div>
|
|
</form>
|
|
|
|
<form class="esqConfigurationForm" id="oidc-new-provider">
|
|
<div
|
|
class="verticalSection verticalSection-extrabottompadding"
|
|
data-expanded="false"
|
|
is="emby-collapse"
|
|
title="Add / Update Provider Configuration">
|
|
<div class="collapseContent hide">
|
|
<div class="inputContainer">
|
|
<label
|
|
class="inputLabel inputLabelUnfocused"
|
|
for="ProviderName">Name of OpenID Provider:</label>
|
|
<!-- We don't add the oidc-text class here because this is not a property on the config this is only used as a map/object key -->
|
|
<input
|
|
class=""
|
|
id="ProviderName"
|
|
is="emby-input"
|
|
required=""
|
|
type="text" />
|
|
<div class="fieldDescription">
|
|
The name used by Jellyfin to identify the OpenID provider.
|
|
<br />
|
|
If an OpenID provider with a matching name does not exist, a
|
|
new provider with this name will be created.
|
|
<br />
|
|
If an OpenID provider with a matching name already exists,
|
|
the settings for that provider will be updated.
|
|
</div>
|
|
</div>
|
|
<div class="inputContainer">
|
|
<label
|
|
class="inputLabel inputLabelUnfocused"
|
|
for="CallbackURL">Callback URL:</label>
|
|
<!-- We don't add the oidc-text class here because this is informational -->
|
|
<input
|
|
class=""
|
|
id="CallbackURL"
|
|
readonly
|
|
is="emby-input"
|
|
required=""
|
|
type="text" />
|
|
<div class="fieldDescription">
|
|
This is the callback URL to give to your OIDC server
|
|
</div>
|
|
</div>
|
|
<div class="inputContainer">
|
|
<label
|
|
class="inputLabel inputLabelUnfocused"
|
|
for="StartURL">Start URL:</label>
|
|
<!-- We don't add the oidc-text class here because this is informational -->
|
|
<input
|
|
class=""
|
|
id="StartURL"
|
|
readonly
|
|
is="emby-input"
|
|
required=""
|
|
type="text" />
|
|
<div class="fieldDescription">
|
|
This is the link to initiate the OIDC Login.
|
|
</div>
|
|
</div>
|
|
|
|
<div
|
|
class="checkboxContainer checkboxContainer-withDescription">
|
|
<label>
|
|
<input
|
|
class="oidc-toggle"
|
|
id="Enabled"
|
|
is="emby-checkbox"
|
|
name="Enabled"
|
|
type="checkbox" />
|
|
<span>Enabled</span>
|
|
</label>
|
|
</div>
|
|
|
|
<div class="inputContainer">
|
|
<label
|
|
class="inputLabel inputLabelUnfocused"
|
|
for="Issuer">OpenID Endpoint:</label>
|
|
<input
|
|
class="oidc-text"
|
|
id="Issuer"
|
|
is="emby-input"
|
|
required=""
|
|
type="text" />
|
|
<div class="fieldDescription">
|
|
The OpenID endpoint. Must have a .well-known path available.
|
|
</div>
|
|
</div>
|
|
|
|
<div class="inputContainer">
|
|
<label
|
|
class="inputLabel inputLabelUnfocused"
|
|
for="ClientId">OpenID Client ID:</label>
|
|
<input
|
|
class="oidc-text"
|
|
id="ClientId"
|
|
is="emby-input"
|
|
required=""
|
|
type="text" />
|
|
<div class="fieldDescription">
|
|
The OpenID client ID, for this media server instance. This
|
|
is configured on the OIDC provider to uniquely identify
|
|
<strong>this</strong> Jellyfin instance.
|
|
</div>
|
|
</div>
|
|
<div class="inputContainer">
|
|
<label class="inputLabel inputLabelUnfocused" for="ClientSecret">OpenID client secret:</label>
|
|
<input
|
|
class="oidc-text"
|
|
id="ClientSecret"
|
|
is="emby-input"
|
|
required=""
|
|
type="password" />
|
|
<div class="fieldDescription">
|
|
The OpenID client secret.
|
|
</div>
|
|
</div>
|
|
|
|
<div
|
|
class="checkboxContainer checkboxContainer-withDescription">
|
|
<label>
|
|
<input
|
|
class="oidc-toggle"
|
|
id="EnableAuthorization"
|
|
is="emby-checkbox"
|
|
name="EnableAuthorization"
|
|
type="checkbox" />
|
|
<span>Enable Authorization by Plugin</span>
|
|
</label>
|
|
<div class="fieldDescription checkboxFieldDescription">
|
|
Determines if the plugin sets permissions for the user.
|
|
<br />
|
|
If false, the user will start with no permissions and an
|
|
administrator will add permissions.
|
|
<br />
|
|
The permissions of existing users will not be rewritten on
|
|
subsequent logins.
|
|
</div>
|
|
</div>
|
|
|
|
<div class="inputContainer">
|
|
<label class="inputLabel inputLabelUnfocused" for="UserRole">User Role:</label>
|
|
<input
|
|
class="oidc-text"
|
|
id="UserRole"
|
|
is="emby-input"
|
|
type="text" />
|
|
<div class="fieldDescription">
|
|
If a user has this role, then the user is
|
|
authenticated. This validates the OpenID response against
|
|
the claim set in <strong>"Role Claim"</strong>.
|
|
<br />
|
|
Leave blank to disable role checking.
|
|
</div>
|
|
</div>
|
|
|
|
<div class="inputContainer">
|
|
<label class="inputLabel inputLabelUnfocused" for="AdminRole">Admin Role:</label>
|
|
<input
|
|
class="oidc-text"
|
|
id="AdminRole"
|
|
is="emby-input"
|
|
type="text" />
|
|
<div class="fieldDescription">
|
|
Like <strong>"User Role"</strong>, but having this role
|
|
confers admin privilege.
|
|
<br />
|
|
Leave blank to not set admin privileges.
|
|
</div>
|
|
</div>
|
|
|
|
<div class="inputContainer">
|
|
<label class="inputLabel inputLabelUnfocused" for="RoleClaim">Role Claim:</label>
|
|
<input
|
|
class="oidc-text"
|
|
id="RoleClaim"
|
|
is="emby-input"
|
|
required=""
|
|
type="text" />
|
|
<div class="fieldDescription">
|
|
This is the value in the OpenID response to check for roles.
|
|
The first element is the claim type, the subsequent values
|
|
are to parse the JSON of the claim value. Use a
|
|
<code>"\."</code> to denote a literal ".". This expects a
|
|
list of strings from the OIDC server.
|
|
<br />
|
|
For Keycloak, it is <code>realm_access.roles</code> by
|
|
default for realm roles. For client roles, it is
|
|
<code>resource_access.>clientId<.roles</code>
|
|
(e.g. resource_access.jellyfin.roles)
|
|
<br />
|
|
For Authelia, it is <code>groups</code>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="inputContainer">
|
|
<label class="inputLabel inputLabelUnfocused" for="Scopes">Request Additional Scopes:</label>
|
|
<textarea
|
|
class="oidc-line-list emby-textarea"
|
|
id="Scopes"
|
|
is="emby-textarea"
|
|
required=""
|
|
type="text"></textarea>
|
|
<div class="fieldDescription">
|
|
Specify additional scopes to include in the OIDC request.
|
|
<br />
|
|
One scope per line, each line should contain a scope name to
|
|
include in the OIDC request.
|
|
<br />
|
|
For some OIDC providers (For example,
|
|
authelia), additional scopes may be required in order to validate
|
|
group membership in role claim.
|
|
<br />
|
|
Leave blank to only request the default scopes.
|
|
</div>
|
|
</div>
|
|
|
|
<div class="inputContainer">
|
|
<label
|
|
class="inputLabel inputLabelUnfocused"
|
|
for="DefaultProvider">Set default Provider:</label>
|
|
<input
|
|
class="oidc-text"
|
|
id="DefaultProvider"
|
|
is="emby-input"
|
|
type="text" />
|
|
<div class="fieldDescription">
|
|
The set provider then gets assigned to the user after they
|
|
have logged in. If it is not set, nothing is changed. With
|
|
this, a user can login with OIDC but is still able to log in
|
|
via other providers later.<br />Default is
|
|
<code>Jellyfin.Server.Implementations.Users.DefaultAuthenticationProvider</code>
|
|
for the default provider.
|
|
</div>
|
|
</div>
|
|
|
|
<div class="inputContainer">
|
|
<label
|
|
class="inputLabel inputLabelUnfocused"
|
|
for="UsernameClaim">Set username claim:</label>
|
|
<input
|
|
class="oidc-text"
|
|
id="UsernameClaim"
|
|
is="emby-input"
|
|
type="text" />
|
|
<div class="fieldDescription">
|
|
The default username claim to use from OpenID by default. If
|
|
it is not set, it defaults to
|
|
<code>preferred_username</code>.
|
|
</div>
|
|
</div>
|
|
|
|
<div class="inputContainer">
|
|
<label
|
|
class="inputLabel inputLabelUnfocused"
|
|
for="DataClaimPrefix">Set Data Claim Prefix:</label>
|
|
<input
|
|
class="oidc-text"
|
|
id="DataClaimPrefix"
|
|
is="emby-input"
|
|
type="text" />
|
|
<div class="fieldDescription">
|
|
The claim prefix to use from OpenID to apply user Policy and Configuration.
|
|
All claims matching the prefix will be sorted by name and then merged, the first item wins.
|
|
Leave empty to not apply any Policy or Configuration.
|
|
<br />
|
|
Default: <code>jellyfin-</code>.
|
|
for example
|
|
<ol>
|
|
<li>jellyfin-2</li>
|
|
<li>jellyfin-10</li>
|
|
<li>jellyfin-0</li>
|
|
<li>jellyfin-1</li>
|
|
</ol>
|
|
will be sorted to
|
|
<ol>
|
|
<li>jellyfin-0</li>
|
|
<li>jellyfin-1</li>
|
|
<li>jellyfin-10</li>
|
|
<li>jellyfin-2</li>
|
|
</ol>
|
|
and jellyfin-0 will take priority.
|
|
<br/>
|
|
<br/>
|
|
Use this select box to show the effective config for a user:
|
|
<div class="selectContainer">
|
|
<label class="selectLabel" for="userSelect">Get config from user:
|
|
</label>
|
|
<select
|
|
class="emby-select-withcolor emby-select"
|
|
id="userSelect"
|
|
is="emby-select"
|
|
name="userSelect">
|
|
<option></option>
|
|
</select>
|
|
<div class="selectArrowContainer">
|
|
<div style="visibility: hidden; display: none">0</div>
|
|
<span
|
|
aria-hidden="true"
|
|
class="selectArrow material-icons keyboard_arrow_down"></span>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="inputContainer">
|
|
<label class="inputLabel inputLabelUnfocused" for="DataClaims">Additional Data Claims:</label>
|
|
<textarea
|
|
class="oidc-line-list emby-textarea"
|
|
id="DataClaims"
|
|
is="emby-textarea"
|
|
required=""
|
|
type="text"></textarea>
|
|
<div class="fieldDescription">
|
|
Specify additional claims to use from OpenID to apply user Policy and Configuration.
|
|
<br />
|
|
Data Claim Prefix takes priority.
|
|
<br />
|
|
Leave empty to not apply any Policy or Configuration.
|
|
</div>
|
|
</div>
|
|
|
|
<div class="inputContainer">
|
|
<label
|
|
class="inputLabel inputLabelUnfocused"
|
|
for="AvatarUrlClaim">Set avatar url claim</label>
|
|
<input
|
|
class="oidc-text"
|
|
id="AvatarUrlClaim"
|
|
is="emby-input"
|
|
type="text" />
|
|
<div class="fieldDescription">
|
|
The claim to get the url for the users avatar from
|
|
</div>
|
|
</div>
|
|
|
|
<div class="checkboxContainer">
|
|
<label>
|
|
<input
|
|
class="oidc-toggle"
|
|
id="PushedAuthorization"
|
|
is="emby-checkbox"
|
|
name="PushedAuthorization"
|
|
type="checkbox" />
|
|
<span>Pushed Authorization. May be need to be disabled for Authelia.</span>
|
|
</label>
|
|
<div class="fieldDescription checkboxFieldDescription"></div>
|
|
</div>
|
|
|
|
<div
|
|
class="checkboxContainer checkboxContainer-withDescription">
|
|
<label>
|
|
<input
|
|
class="oidc-toggle"
|
|
id="ValidateEndpoints"
|
|
is="emby-checkbox"
|
|
name="ValidateEndpoints"
|
|
type="checkbox" />
|
|
<span>Validate OpenID Endpoints</span>
|
|
</label>
|
|
<div class="fieldDescription checkboxFieldDescription">
|
|
Disable for Google OAuth
|
|
</div>
|
|
</div>
|
|
<div class="checkboxContainer">
|
|
<label>
|
|
<input
|
|
class="oidc-toggle"
|
|
id="ValidateIssuerName"
|
|
is="emby-checkbox"
|
|
name="ValidateIssuerName"
|
|
type="checkbox" />
|
|
<span>Validate OpenID Issuer Name</span>
|
|
</label>
|
|
</div>
|
|
<div class="inputContainer">
|
|
<label class="inputLabel inputLabelUnfocused" for="AuthenticationTimeout">Authentication Timeout</label>
|
|
<!-- TODO: This is not loading the default -->
|
|
<input
|
|
class="oidc-text"
|
|
id="AuthenticationTimeout"
|
|
is="emby-input"
|
|
name="AuthenticationTimeout"
|
|
type="number" />
|
|
<div class="fieldDescription">
|
|
Time in minutes to wait for an authentication to complete
|
|
</div>
|
|
</div>
|
|
<div
|
|
class="checkboxContainer checkboxContainer-withDescription">
|
|
<label>
|
|
<input
|
|
class="oidc-toggle"
|
|
id="LoadProfile"
|
|
is="emby-checkbox"
|
|
name="LoadProfile"
|
|
type="checkbox" />
|
|
<span>Load Profile Information</span>
|
|
</label>
|
|
<div class="fieldDescription checkboxFieldDescription">
|
|
May be required for Cloudflare OpenID
|
|
</div>
|
|
</div>
|
|
|
|
<div class="inputContainer">
|
|
<label class="inputLabel inputLabelUnfocused" for="RoleClaim">Port Override</label>
|
|
<input
|
|
class="oidc-text"
|
|
id="PortOverride"
|
|
is="emby-input"
|
|
type="text" />
|
|
<div class="fieldDescription">
|
|
If the plugin is redirecting to an incorrect port, set this
|
|
to the appropiate port
|
|
</div>
|
|
</div>
|
|
|
|
<button
|
|
class="raised button-submit block emby-button"
|
|
id="SaveProvider"
|
|
is="emby-button"
|
|
type="button">
|
|
<span>Save</span>
|
|
</button>
|
|
<button
|
|
class="raised button-delete block emby-button"
|
|
id="DeleteProvider"
|
|
is="emby-button"
|
|
type="button">
|
|
<span>Delete Provider</span>
|
|
</button>
|
|
</div>
|
|
</div>
|
|
</form>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</body>
|
|
|
|
</html>
|