Record the login-latency baseline from a controlled run [#1118]
The Latency section carried a Pending marker, so the page named a
characterization it did not hold and the release-over-release comparison it
exists for had no first term. Nothing was measurable from it.
Records the p50/p95/p99/max distribution for both scenarios and the
concurrent throughput from the scheduled Performance baseline run on a
GitHub-hosted runner, with the provenance that makes a later run comparable:
runner label and image, processor count, SDK and runtime, plugin commit,
harness parameters and the run URL. States what the harness excludes, so the
numbers are not read as a deployment's login latency, and says the max column
tracks runner noise rather than the plugin. The closing criterion list no
longer says a controlled run is pending.
2fd2287
Document AllowPrivateNetworkAddresses and route the blocked-address failure to it [#1280]
The setting shipped fully wired - model, admin form, insecure-toggle audit,
config export/import, and the transport that honours it - and nothing outside
the source described it. An administrator whose identity provider lives on
their own network met "The outbound host resolves only to blocked addresses"
with no documented setting to reach for, which is the state that produces a
workaround instead of the opt-in.
Adds a section to the Options Reference stating what the toggle widens, that
it is per provider and off by default including across an upgrade, that
enabling it is recorded as a downgrade, and what it explicitly does not
relax. The Security Model's outbound-fetch section said every fetch is pinned
to public addresses, which stopped being the whole truth when the second
outbound tier landed; it now carries the exception, its bounds, and the link,
so the failure text routes to the setting.
8d62379
Add the one-implementation-per-security-primitive family [#1048]
Section 1 listed every architecture rule family a change is held to except
this one, while two conformance rules already enforced it. A contributor met
the family as a red build with no page explaining why the rule exists or how
far it reaches, which is the drift the single-home doctrine exists to stop.
The entry names both fitness functions, does not restate their mechanics, and
states the limit both share: they are source scans, so a second construction
inside an already-declared file and a path that reaches the same decision
without naming the library type are outside them, and the review gate owns
those. Written from the rules on main rather than from the issue's sketch,
which named the OpenID rule under a working title it did not ship under.
6b1ca74
Add the Quick Connect round trip to the manual E2E gate [#1114]
The manual E2E checklist covered federation, deployment topology and the
browser dashboard, and nothing in it exercised a native client. The plugin
implements no Quick Connect itself, so the capability that answers "SSO
plugins are web-UI only" was verified nowhere: the in-repo harness drives a
headless browser against the plugin's own endpoints and cannot reach a
native client, and no manual item asked anyone to try.
Adds a Native clients sub-section under section 6 with one item per protocol,
each carrying the reason it stays manual, and requires the client app and
version to be recorded so a later run is reproducible. A client that cannot
complete the round trip is a recorded result, not a blank box. The
behavioural description stays on the Login Flow page and is linked rather
than restated.
eb2e8fb
Replace the typographic dashes on every page
612 dashes across 22 of the 30 pages. No page ends a line with a
space afterwards, and 566 dashes that would have started a Markdown list are
escaped so the list does not appear.
A wiki has no pull request and no gate, so the counts before and after are the
evidence: the run is recorded in iderex/operations#861.
Part of the fleet-wide pass in iderex/operations#860.
Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com>
8f50e2e
Replace the auto-redirect placeholder with what the live server does [#722]
The hide-password recipe promised an auto-redirect recipe "once it has been
verified against a live Jellyfin server". Verified now, on Jellyfin 10.11.11
with plugin 4.3.0.16 from manifest-beta: it cannot be written.
Jellyfin sanitises the branding disclaimer before it reaches the login page. A
script block, an onerror attribute and a meta refresh are each stripped; links
and formatting survive. That is exactly what makes the managed button block
safe to splice in, and it is the same reason no disclaimer snippet can navigate
on its own. The placeholder is replaced by that finding, with the remaining
out-of-plugin routes named and their lockout risk stated.
The CSS rule in step 2 is confirmed on the same server - served back by
GET /Branding/Css and applied to the login page - and it is noted that the
plugin manages only the disclaimer region, so an upgrade does not rewrite an
admin's own Custom CSS.
Deliberately kept to one home: the recipe stays where it already lived rather
than gaining a second section beside it.
Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com>
5556d3f
Stop citing the de-published docs/ARCHITECTURE.md [#987]
#987 un-tracked docs/ARCHITECTURE.md so it lives only in the local docs/ area.
Two wiki citations of that path survived and became dead public links, which is
what Wiki Lint has been failing on since the #996 merge.
The Architecture page no longer presents itself as a distillation of an in-repo
source that readers cannot open: it is the single home for the architecture,
with the code and its conformance tests still winning any disagreement. The
migration issue references it carried are kept, now as working links rather than
plain text.
Coding-Standards named CLAUDE.md and docs/ARCHITECTURE.md alongside
CONTRIBUTING.md as the files that point here; neither is public, so the sentence
described the repository to readers who cannot verify it. It now names only
CONTRIBUTING.md.
Verified with the real gate against a tracked-only tree built from
origin/main (git archive), because the un-tracked file is still present on a
working checkout and makes a local run report clean either way: the unmodified
wiki reproduces both findings and exit 1, this state reports clean and exit 0.
Signed-off-by: iderex <30603423+iderex@users.noreply.github.com>
aa4de5a
Flip Home status Beta -> Release Candidate (RC promotion)
Mirrors the README/config-page maturity flip; all four Beta->RC gates met.
Refs #716
3729cca
Fix Home + de-link the pages that moved to internal docs
The five process pages that moved to the local docs/ (Roadmap, Threat-Model,
Delivery-Metrics, Security-and-Maturity-Self-Assessment, Native-OIDC-Coexistence)
are wiki stubs now, but Home and several public pages still linked them. Clean
Home's page list, de-link the internal pages from Installation, Migrating-from-9p4,
Releasing, and Security-Model (keeping the surrounding text and the maturity-ladder
wording inline), point Home at the public Comparison page for the native-OIDC
stance, and fix Home's install wording (adding the plugin's own repository, not the
built-in catalog).
Refs #822 #987
fb9d3b4
Add a Comparison page; link it in the sidebar
Move the "How it compares" table (this plugin vs. Jellyfin built-in auth, the
official LDAP plugin, and the archived 9p4 plugin) out of the README into its
own wiki page, with the native-OIDC-coexistence stance folded in, and link it
under "How it works". Keeps the README a lean start.
Refs #987
398fb46
Move five process pages to local docs; first-person voice
Delivery-Metrics, Native-OIDC-Coexistence, Roadmap,
Security-and-Maturity-Self-Assessment, and Threat-Model now live in the
project's internal docs/ (kept locally, not published); each wiki page is
reduced to a short "moved, now internal" stub for URL stability, and the
sidebar drops them. Also fix a third-person "the maintainer" translation
artifact (it means me, the sole author) in Releasing, Review-Gate, and
Security-Conformance.
Refs #987
1764539
Updated Security Conformance (markdown)
52f3d0b
Consolidate the Provider-Setup option sections into one options pointer
Provider-Setup carried 19 'Moved: see …' redirect stubs plus two summary sections, each pointing at per-provider options already documented in Hardening & Options Reference / Security Model — the scattered-reference pattern we are consolidating away. Fold all of them into one 'Configuring a provider — options and hardening' section that keeps the basic RBAC config example (whose single home is this setup page) and points to the two single homes. The page is now the per-provider setup walkthroughs plus that one pointer. No dead internal anchors; the option content is unchanged in its homes.
Signed-off-by: iderex <30603423+iderex@users.noreply.github.com>
a8b7ede
Add the login-path performance and load baseline characterization (#742)
New single-home page characterizing the login path's load behavior: the authorize-state store cap/sweep/concurrency, the per-client rate limiter, and the avatar deadline, each cited to its existing regression test (behavioral demonstration rather than a construction claim), linking to the Security Model design homes rather than duplicating them. Latency numbers are honestly marked pending a controlled CI/live run. Linked from the sidebar under How it works.
Signed-off-by: iderex <30603423+iderex@users.noreply.github.com>
8f840e6
Document the managed login-page buttons and the hide-password recipe
Add the #722 auto-managed 'Sign in with ...' buttons (ManageLoginPageButtons, per-provider HideLoginButton / LoginButtonText, HTML-encoded labels, start routes) and the hide-password-form recipe to the single options-reference home. The recipe is explicit that the CSS is cosmetic and DisablePasswordLogin is the enforced fail-closed control. The auto-redirect recipe and screenshots are left for live-server verification (#722).
Signed-off-by: iderex <30603423+iderex@users.noreply.github.com>
d1da4a4
Document DisableAccountOnRoleDenied and OpenID back-channel logout in the options reference
Add the two config-only per-provider toggles from #831 (login-time deprovisioning) and #962 (inbound OIDC back-channel logout) to the single options-reference home: what each does, opt-in/off-by-default, the mass-lockout fail-safe (admins never disabled), the issuer binding, the no-self-heal operator note, the back-channel endpoint to register, the NAT reachability caveat, and the audit line. Self-contained; links to the existing single homes for issuer binding and single-logout design rather than duplicating. Closes #974, #976.
Signed-off-by: iderex <30603423+iderex@users.noreply.github.com>
0b6b491
Document permission-role mapping; scope the scalar policy fields (#827)
The full boolean PermissionKind surface has been claim-mappable since #164
(EnablePermissionRoles + PermissionRoleMappings) but was undocumented, so the
most-upvoted upstream ask (9p4#295 'User Policy from Claims', 9p4#95 'User
Options via Roles/Groups') read as unimplemented. Adds a Hardening & Options
Reference section covering the config shape, the deny-by-default/authoritative
semantics, the PermissionKind names, the dedicated-permission exclusions, and
save validation, plus a Provider-Setup pointer. Field names verified against
PluginConfiguration.cs + PermissionRolePolicy.cs on main. The remaining scalar
fields (max bitrate, max sessions) that are not PermissionKinds stay tracked in
#827.
2ffd7a8
Refresh the SAML setup wording for the full admin form (#856, #725)
The Hardening & Options Reference still described several SAML settings as
config-XML-only from before #725 shipped the full SAML provider form. Updated
the how-you-set-it wording only; the security guidance is unchanged:
- header note: both provider types have a full form, config-XML-only settings
are called out explicitly where they remain
- provision-new-users-pending-approval: a toggle on BOTH forms now
- Base URL Override: a form field on both forms (SAML under Compatibility &
overrides)
- metadata import: the form's URL/XML import fields pre-fill endpoint, SLO
endpoint and signing certificate; the admin endpoint stays documented as the
direct route
- SP signing keys: write-only form fields, blank-keeps-stored semantics stated
- inbound secondary IdP certificate: its own form field
- SP metadata: the form's read-only computed ACS URL and SP metadata URL with
copy buttons, derived from the canonical base URL
- Test Connection: the button exists on both forms
cc5360c
Add Dex and Zitadel provider guides; document the beta-only channel (#932, #937, #954, #956)
Provider Setup gains Zitadel (object-map role claim urn:zitadel:iam:org:project:roles
with RoleClaimIsObjectMap, projectRoleAssertion + idTokenRoleAssertion both required,
role grants per user) and Dex (login round-trip; the built-in password database carries
no groups, so RBAC needs an upstream connector; no preferred_username - the username
comes from the name claim). Both recipes mirror the plugin's automated end-to-end
harnesses, so every setting is verified nightly.
Beta-only sweep (#954/#956): Installation and Migrating-from-9p4 point at the beta
repository URL only (the stable manifest is emptied until the first stable release);
Releasing and Rollback carry a status note and describe the JF12 leg publishing from
main (the 4.2 branch is retired); the catalog name is Community SSO for Jellyfin.
f534e40
Consolidate the wiki: canonical Coding Standards, merged Architecture, split Provider Setup
Restructure the wiki into one coherent, audience-grouped set with a single home
for each fact.
- New Coding-Standards page: the one canonical statement of the architecture,
comment/documentation (#864), and object-oriented rules; the repo's CLAUDE.md
and CONTRIBUTING.md now point here instead of restating them.
- Merged the two stale, mutually-overlapping Architecture pages into one, re-based
on the current module-DAG reality (the old pages claimed the module split was
"not pursued" and that no IPluginServiceRegistrator existed — both were wrong
and contradicted docs/ARCHITECTURE.md). Cites modules and types, never
file:line, so it cannot drift on a move again.
- Split Provider-Setup (1172 lines, ~73% not provider-specific) into Provider
Setup (recipes) + a new Hardening & Options Reference; folded the security-
control narrative into the Security Model. Every moved section left a pointer.
- Merged Release-Policy + Release-QA-Checklist into Releasing (renamed the
per-release ladder to "release promotion ladder" to end the Beta-rung name
collision); merged OpenSSF-Best-Practices + Maturity-Map into Security &
Maturity Self-Assessment. Old slugs kept as redirect stubs.
- Rebuilt the sidebar into four audience groups (Getting started / How it works /
Security / Standards & process). Fixed the broken anchors, corrected the beta
publish-trigger to the daily scheduler (it is not "every merge"), de-referenced
the design records to module/type names, and trimmed Home's README duplication.
e8d2934
Document the SAML metadata-import endpoint (#735)
5664f06
Note the OIDC form now shows and copies the redirect URI (#724)
2999339
Document the parental-rating-by-role mapping (#736)
cd1926e
Document the OIDC step-up / MFA options (#757)
2aeb6ae
Document the provision-new-users-pending-approval workflow (#737)
d651ec2
Record the minimum signing-key strength floor as Met (#733)
5d4f562
Reflect the OIDC SSRF parity landing (#755) in the security docs
The Security-Conformance V12 row flips from Met(avatar)/Partial(OIDC) to Met (the shared hardened transport in Api/Net/SsoHttp now guards discovery/JWKS/token/userinfo), and the #755 accepted-residual is removed; the Security-Model SSRF section is broadened from avatar-only to all outbound fetches with the shared connect-time guard.
eea6e33
Publish the ASVS 5.0 + RFC 9700 security conformance self-assessment [#734]
New Security-Conformance wiki page: maps the RP authentication surface to OWASP ASVS 5.0 (V1 output/CSP, V6 auth incl. id_token + SAML XSW resistance, V7 session/revocation, V8 authz/last-admin, V11 crypto, V12 SSRF, brute-force) and the RFC 9700 OAuth BCP (PKCE-S256, exact redirect-URI, RFC 9207 iss/mix-up, no implicit/hybrid/ROPC; DPoP/JARM/PAR N-A-by-role justified), each row Met/Partial/N-A with a source-file citation. Accepted-residuals section records the min-key-strength floor (#733) and discovery/JWKS SSRF parity (#755) as open with reasoned risk, header completeness as met, and #708 as fixed. Framed as a maintainer self-assessment, no certification. Linked from Home and the sidebar.
889a1eb
Refresh the Architecture-Internals file paths after the module refactors [#823]
The module migration (#777) and its #807 kernel-dissolution finale moved several types out of the flat Api root: SSOController -> Api/Http, VerifiedIdentity -> Api/Identity, LoginOutcome -> Api/Session, and Saml.cs split into SamlResponse.cs (parser core) + SamlAuthnRequest.cs. Update every stale file path on the page (the flow trees, the outcome section, the extraction note, and the What-lives-where table) and refresh the controller line count.
cca5acb
Add an honest Silver/Gold/OSPS maturity map [#749]
New Maturity-Map wiki page: Met/Planned/Structurally-N-A buckets against OpenSSF Silver, Gold and OSPS Baseline. States prominently that review is single-maintainer + AI-assisted and the CODEOWNERS accounts are the maintainer team, not independent auditors; dispositions Gold bus_factor, contributors_unassociated, two_person_review and OSPS-QA-07.01/AC-03.01 as not-met-by-design with named compensating controls. Linked from Home and the sidebar.
695546d