Comparison

How it compares

Honest positioning against the alternatives - pick what fits your setup.

	This plugin	Jellyfin built-in auth	Official LDAP plugin	Archived 9p4 plugin
Sign-in model	Delegated to your IdP (OIDC / SAML)	Local passwords	Directory bind (LDAP/AD)	Delegated to your IdP (OIDC / SAML)
Passwords touch Jellyfin	No (optional SSO-only mode)	Yes	Yes (bind credentials)	No
Role / permission mapping	✔ from IdP claims (admin, folders, Live TV)	Manual per user	✔ from LDAP attributes	✔ from IdP claims
Account linking (existing users)	✔ self-service	n/a	✔ (by username)	✔
Maintenance status	Active (Beta)	Active (core)	Active (official)	Archived, unmaintained
Security process	Adversarial review + CI gates per change (Review Gate)	Jellyfin core process	Jellyfin org process	-
Native clients	Via Quick Connect	✔ everywhere	✔ everywhere	Via Quick Connect
Best when	You run an IdP (or want one) and want passwords out of Jellyfin	Small setups, no IdP	You have AD/LDAP but no web IdP	(migrate here - guide)

The LDAP plugin and this one solve different problems and can even coexist; if you already run Authelia/authentik/Keycloak, this plugin is the direct path. Coming from the archived 9p4 plugin, migration is an in-place upgrade.

Relationship to Jellyfin's upcoming native OIDC

Jellyfin upstream is building native OIDC (13.0 at the earliest). This plugin complements it rather than competing: it remains the option for SAML 2.0, folder / Live-TV role mapping, account linking, avatar sync, and SSO-only mode - and for every current server release, since native OIDC will not reach existing 10.11 servers.