Troubleshooting

Troubleshooting

"Invalid or expired state" after an OpenID login

The login-state entry lives for about a minute. If the round-trip to your provider takes longer, or the callback lands on a different plugin instance, retry the sign-in. States are per-instance and in-memory.

SAML login is refused

Because SAML validation is fail-closed, a rejected login usually means one of:

• the response signature does not cover the consumed assertion, or is missing;
• the assertion is expired or not yet valid (check clock sync between your IdP and server);
• the assertion's AudienceRestriction does not match this service provider (set the expected audience, or opt out only if your provider cannot emit it);
• the same assertion was already used (replay).

Check the server log for the specific [SSO entry.

"SSO login is not permitted for this account"

A first SSO login matched an existing, unlinked Jellyfin account with the same name. This is refused by default to prevent account takeover. If adopting that account is intended, enable AllowExistingAccountLink for the provider, or link it via /SSOViews/linking.

The plugin does not load

Make sure you copied the full publish output (all DLLs), not just SSO-Auth.dll. See Installation.

---

Still stuck? Open an issue with your Jellyfin version, plugin version, provider, and the relevant [SSO log lines (redact secrets).