SSO Settings:

${Help}

Note: Making changes to this configuration requires a restart of Jellyfin.
This plug-in is in early development, not all configuration options have been implented in the UI.
See the help page and roadmap for more information.
To allow users to manage their own SSO accounts, including linking SSO providers, and removing existing links, they need to visit the self service page .
You can use custom menu links to accomplish this.

0
The name used by Jellyfin to identify the OpenID provider.
If an OpenID provider with a matching name does not exist, a new provider with this name will be created.
If an OpenID provider with a matching name already exists, the settings for that provider will be updated.
The OpenID endpoint. Must have a .well-known path available.
The OpenID client ID, for this media server instance. This is configured on the OIDC provider to uniquely identify this Jellyfin instance.
The OpenID client secret.
Determines if the plugin sets permissions for the user.
If false, the user will start with no permissions and an administrator will add permissions.
The permissions of existing users will not be rewritten on subsequent logins.
If a user has this role, then the user is authenticated. This validates the OpenID response against the claim set in "Role Claim".
Leave blank to disable role checking.
Like "User Role", but having this role confers admin privilege.
If unset will not grant admin privileges.
This is the value in the OpenID response to check for roles. The first element is the claim type, the subsequent values are to parse the JSON of the claim value. Use a "\." to denote a literal ".". This expects a list of strings from the OIDC server.
For Keycloak, it is realm_access.roles by default for realm roles. For client roles, it is resource_access.>clientId<.roles (e.g. resource_access.jellyfin.roles)
For Authelia, it is groups
Specify additional scopes to include in the OIDC request.
One scope per line, each line should contain a scope name to include in the OIDC request.
For some OIDC providers (For example, authelia), additional scopes may be required in order to validate group membership in role claim.
Leave blank to only request the default scopes.
The set provider then gets assigned to the user after they have logged in. If it is not set, nothing is changed. With this, a user can login with SSO but is still able to log in via other providers later.
Default is Jellyfin.Server.Implementations.Users.DefaultAuthenticationProvider for the default provider.
The default username claim to use from OpenID by default. If it is not set, it defaults to preferred_username.
The claim prefix to use from OpenID to apply user Policy and Configuration All claims matching the prefix will be sorted by name and then merged, the first item wins.
Default: jellyfin-. for example
  1. jellyfin-2
  2. jellyfin-10
  3. jellyfin-0
  4. jellyfin-1
will be sorted to
  1. jellyfin-0
  2. jellyfin-1
  3. jellyfin-10
  4. jellyfin-2
and jellyfin-0 will take priority
Specify additional claims to merge into the .
One scope per line, each line should contain a scope name to include in the OIDC request.
For some OIDC providers (For example, authelia), additional scopes may be required in order to validate group membership in role claim.
Leave blank to only request the default scopes.
The claim to get the url for the users avatar from
Disable for Google OAuth
Time in minutes to wait for an authentication to complete
May be required for Cloudflare OpenID
If the plugin is redirecting to an incorrect port, set this to the appropiate port