Home

Note

Status: Release Candidate - the fourth rung of the maturity ladder (In-Development → Alpha → Beta → Release Candidate → Full Release). Installable by adding this plugin's own repository to Jellyfin (it is not in the built-in catalog); see Installation.

Jellyfin SSO Plugin - Wiki

Sign in to Jellyfin through OpenID Connect or SAML 2.0 identity providers.

Status: this is a security-first revival of the archived 9p4/jellyfin-plugin-sso. It continues from the last upstream release (4.0.0.x, Jellyfin 10.11 / .NET 9), taken forward one reviewed change at a time and drawing on its hardened sibling project, jellyfin-plugin-sso-V2 (private). This wiki grows with the plugin - pages describe what is actually implemented today, not planned features. If something here disagrees with the code, the code wins; please open an issue.

Pages

User docs

• Installation - add this plugin's repository, then install from the in-app catalog, or build from source.
• Migrating from 9p4 - switching from the archived upstream (it is an in-place upgrade).
• Provider Setup - per-identity-provider configuration guides (Authelia, Authentik, Keycloak, Pocket ID, Kanidm, …).
• Troubleshooting - what a specific login rejection means.

Architecture & security

• Login Flow - how an OpenID or SAML sign-in works, end to end.
• Security Model - how the login path fails closed.
• Security Conformance - the ASVS 5.0 + RFC 9700 self-assessment (Met / Partial / N-A, with accepted residuals).
• Architecture - the coding standard and the target architecture the code is converging on.

Process & release

• Review Gate - the internal-only merge gate: what it covers, class by class.
• Releasing - the channel/soak promotion model and the manual pre-promotion QA checklist for shipping a release.
• Rollback - how to contain and reverse a bad release.

Design records

• SSO-Only Login Design - the threat model SSO-only login was built to (implemented; the runbook is in Security Model).
• Single Logout Design - design note for SAML/OIDC single logout (SLO).
• Comparison - how this plugin compares to Jellyfin's built-in auth, the LDAP plugin, and the archived 9p4 plugin, and its stance on Jellyfin's upcoming native OIDC.

What it does today

Sign in to Jellyfin through OpenID Connect or SAML 2.0 identity providers, with role-based access, optional SSO-only login, avatar sync, Quick Connect, and self-service account linking - on a fail-closed login path. For the full feature list see the README and Installation; how the login path fails closed is on the Security Model page.

Reporting security issues

Report vulnerabilities privately via the repository's Report a vulnerability form - not the public issue tracker.