Admin page

[9p4]

Tracking issue for the admin page

[strazto]

I'm working on this on my fork, btw

Roadmap

Steps:

• Implement OIDC Config
• Implement SAML Config

Future work:

• Revisit help texts, particularly Add UI Page for OIDC Configuration #18 (comment) (Enable Authorization)
• Input validation
  • Optional json fields should send empty placeholder Allow configuration of OIDC scopes to request to support role-claim #23 (comment)
• Improve UX for configuring complex properties
  (JSON is not acceptable long term)
  • 1a Folder selection should resemble https://github.com/jellyfin/jellyfin-plugin-ldapauth
    Add UI Page for OIDC Configuration #18 (comment)
    
  • Role Selection
    • Add UI Page for OIDC Configuration #18 (comment)
    • (Applies to both admin role & standard role)
    • won't work like folder selection, as listing roles requires authenticating with SSO provider to enumerate roles
      Options:
      • 2a Give role lists as multiline text input, split on newline (Relatively simple, decent UX)
      • 2b Implement some kind of list-append dialog, similar to builtin library / folder management (More complex, better UX)
        
• Role -> Folder Mapping
  • Add UI Page for OIDC Configuration #18 (comment)
  • I envisage this will look like a combination of 2b + 1a, where selecting the "+" (add) button creates a dialog with a text input, for the role name, and a set of checkboxes for each library that role should have access to.

Lower priority:

• Allow branding css + disclaimer to be auto-filled from plugin config #19 login disclaimer generation

[9p4]

Thank you very much! Looking forward to the PR.

[strazto]

Thank you very much! Looking forward to the PR.

So far, frontend is set up and fetching config is half done, then I had to work on my actual job that I was procrastinating 🙃

Most of what I struggled with was figuring out how to add the embedded js resource (you gotta add a reference in the csproj as well as in the embedded page def)

I'm mainly doing this because having a convenient admin page is what I'd consider to be the requirements I need to actually use this on my server.

I'm planning on only implementing a frontend for oidc, then with some feedback, I might extend it to saml, or someone else can since it'll be straightforward enough given it'll be basically the same as oidc.

On an unrelated note
I am curious- when you develop locally, how do you test against an authentication instance, since the host is probably http://localhost?

Also, I might like some guidance / help with mapping some fields/terminology from keycloak to authelia, in particular the role - focussed configurations

I'll raise that second question when I get to that point, though (happy to discuss in separate issues, but I'm just getting to work now)

[strazto]

Since I'm filling this issue with unrelated clutter already (dw I'll clean it up in a bit), I was also thinking I might document how to use the server's branding options to add a SSO link to the front page ( I think that's the only way you can add it, any markdown compatible html can be added, and style sheets)

In another pass, I may even write up something on the config frontend that generates SSO buttons and css for the login page

[9p4]

I am curious- when you develop locally, how do you test against an authentication instance, since the host is probably http://localhost/?

I run my own Keycloak instance so I just have the redirect URL set to localhost/whatever

Also, I might like some guidance / help with mapping some fields/terminology from keycloak to authelia, in particular the role - focussed configurations

I haven't really used Authelia. I'll spin up an instance and see if I can grok it.

I was also thinking I might document how to use the server's branding options to add a SSO link to the front page

I hadn't thought of that. That would be super cool 11/10

[strazto]

I run my own Keycloak instance so I just have the redirect URL set to localhost/whatever

Yeah, sweet, I haven't actually set up the oidc provider part of authelia SSO yet - I was concerned that itd be limited to my domain but I'm sure it's just a setting

I haven't really used Authelia. I'll spin up an instance and see if I can grok it.

If you understand keycloak, you'll understand authelia - it's the same thing except much less.

Keycloak is probably more suitable for enterprise, but I found authelia was much easier to configure and get started with.

Personally, I use authelia + LLDAP (that's Light LDAP, a super simple opinionated implementation) for most of my auth stack - if you're running openldap + keycloak, then this stack will be very easy

Don't stress about running authelia yet, once I get this PR in, I'll set up oidc on my authelia instance and make sure I can authenticate for localhost hostnames, and see how I go from there - once I have actual flow state responses to compare I'll have more specific questions for you.

I do think that the roleClaim docs could be clarified - when you say "parse json" do you literally mean the string specifies the json subtree access, eg:

{
 "a" : 
      {
          "b" : { "user.group" : "admin" }
      }
}

Would be given as "a.b.user\.group" or whatever?

[9p4]

I do think that the roleClaim docs could be clarified - when you say "parse json" do you literally mean the string specifies the json subtree access, eg: [...] Would be given as "a.b.user.group" or whatever?

Yes! I'll see if I can clarify that in the docs

[strazto]

Pinging to reopen this as the feature is incomplete

[9p4]

Whoops

[9p4]

Let's add input validation too

#23 (comment)

[strazto]

Okay revisiting this, since I get the impression we're not pushing a release until it's finished.
Priority will be the UX improvements we discussed for OIDC config, then extending that to SAML

[9p4]

Honestly, I don't want to rush out a new release right now (especially since JF 10.8 isn't even stable yet).

[Cookie-Monster-Coder]

I think it's better if releases are pushed out and versioned incrementally.

In the current stage of the plugin I'm not able to login using Jellyfin's User/pass which is needed for Phones and TV as they can't login via SSO. This pull request fixes that #9 but, it's not in the latest release.

[strazto]

I agree with @Cookie-Monster-Coder
JF 10.8 may not be stable, and the plugin may not be stable, but releases have 2 benefits:

1. They enable people to install the plugin without too much hassle
2. They give a semi-stable point of reference for a point at which the plugin has been incrementally improved, and can be considered to be "usable"

We can provide releases with the caveat that the plugin is still immature. I'll move this to its own issue.

[9p4]

Sure, I'll put out a new release as soon as #27 is merged.