There was an error while loading. Please reload this page.
Scope the two ABI lines separately for RC [#743] Add section 9: the 4.x/JF10.11 line reaches RC now on its 10.11 live gate; the 5.0/JF12 line has a separate RC gate with a deferred live-validation trigger (run a JF12 E2E variant when a JF12 RC/GA server exists, watching the .NET 10 crypto-assembly exclusion and legacy-auth login #136); until then the JF12 beta is labelled unvalidated-against-live.
Reword to first-person voice [#721]
Add the user-facing polish gate to the Beta-to-RC list [#753] The RC gate now includes the user-facing docs/marketing definition of done, tracked item by item in the #822 meta-issue; the promotion-evidence paragraph names its artifact (the checked-off polish list).
Publish the native-OIDC coexistence stance [#721] New Native-OIDC-Coexistence page: upstream watch (jellyfin#17271 open, 13.0 at the earliest; discussion #16470), the complementary-and-strictly-broader stance, a capability comparison against the native draft, and the link-model migration honesty ((mode, provider name, subject) + TOFU issuer vs upstream's (providerId, issuer, subject) key; legacy username links; SAML links stay plugin-owned). Roadmap gains the Upstream-watch section; Home and the sidebar link the page.
Add wiki navigation: curated sidebar and footer [#752] Sidebar mirrors Home's four sections (user docs, architecture & security, process & release, design records) so every page carries the full map; footer carries the repo links, the private-security-reporting pointer and the wiki's code-wins disclaimer. Closes #752 (wiki side).
Roadmap: document how Beta→RC promotion is decided (P8 epic #716)
Updated OpenSSF Best Practices (markdown)
Clarify distribution: independent repository, not the official catalog (#739) Note under Installation that this is an independent plugin repository (Jellyfin's built-in catalog lists only jellyfin-org plugins; no official SSO plugin exists), and record the distribution decision in the Roadmap: independent for now, org adoption path kept open.
Advance maturity to Beta and add the role-gate denial troubleshooting entry Flip Home/Roadmap/Migrating from Alpha to Beta for the 4.3.0 release: drop the Alpha for-testing-only warning block for a concise Beta status, move the ladder marker to Beta, and soften the production-use wording to Beta-appropriate. Add a Troubleshooting entry mapping the reworded role-gate denial message (#668).
Updated Delivery Metrics (markdown)
Document SSO-only login: runbook, security summary, lockout recovery The mode shipped (#665) but the wiki still called it not implemented, and the settings page points at a Provider Setup runbook that did not exist. - Provider Setup: full operator runbook (enforcement semantics, break-glass guard, the four elevation-gated endpoints, server-managed state, recovery) - Security Model: enforcement-property summary and the audited transitions - Troubleshooting: locked-out recovery entry (break-glass, config-XML edit) - SSO-Only Login Design: status corrected to implemented, kept as the record - Home: feature listed under what it does today
Refresh wiki to Alpha stage, packaged-release install, and three-part versioning - Home/Installation/Migrating: replace the In-Development banner with the Alpha maturity; document the plugin-catalog install (stable/beta manifest URLs) and the multi-target net9.0/net10.0 build for Jellyfin 10.11 and 12.0; drop the build-from-source-only / no-manifest wording now that the channels are live. - Release-Policy/OpenSSF: describe the three-part X.Y.Z scheme, with the channel and Jellyfin generation as a tag/release-name suffix and Z covering both bug-fix and security, instead of the retired four-part X.Y.Z.W (W=security). - Provider-Setup: fix "recieve" typo. - OpenSSF/Release-Policy/Release-QA-Checklist/Rollback/Threat-Model: use the wiki page name as link text for docs that moved out of the repo (Review Gate, Rollback, Release QA Checklist, Provider Setup, Architecture Internals, Threat Model).
Migrate design, process, and provider docs from the repo into the wiki Add wiki pages for the per-provider setup guides, the delivery-pipeline threat model, the release/rollback/review-gate/QA process docs, the DORA delivery metrics, the OpenSSF best-practices assessment, the single-logout and SSO-only-login design notes, and an architecture-internals code map. Retarget every internal link: cross-doc references now point at wiki pages, references to files that stay in the repo point at full github blob URLs, and provider screenshots point at raw.githubusercontent URLs. Add a grouped navigation to Home (user docs / architecture & security / process & release / design records), cross-link Login-Flow and Architecture with the new Architecture-Internals map, and cross-link Security-Model with Threat-Model.
Architecture: mark the structural core delivered and conformance-locked The four-layer shape, the VerifiedIdentity evidence keystone, the per-protocol flow spine, LoginCompletionService, and the naming/purity rules have all landed and are enforced by the 28-rule conformance suite. Reframe the page from a target being migrated toward to the standard now in force, and state honestly what was deliberately not pursued (the controller partial-split and the top-level domain-folder reorg) as churn the conformance tests make unnecessary.
Advance the maturity ladder marker to Alpha v4.1.0.0 is released and installable from the Jellyfin plugin catalog, so the current stage moves from In-Development to Alpha. Softens the pre-release caveat to match (testing/evaluation only, not production; a login path still being hardened).
Document issuer-binding, secrets-at-rest, and the legacy-link upgrade path Mirror the current providers.md security posture onto the wiki: - Security-Model: issuer-bound OpenID links (repointing protection), secrets encrypted at rest (ssoenc envelope + downgrade note), and the admin-account exemption for the legacy username-keyed link migration. - Migrating-from-9p4: issuer-binding behavior and the encrypted-secret rollback caveat. - Troubleshooting: the post-upgrade gated legacy-link case (403 / fresh account). Closes #371.
Document the login browser binding, SAML response-binding options, and per-client in-flight capacity Merged since the last wiki pass: the SAML browser-binding cookie (#415) alongside the existing OpenID one, and the per-client share of the in-flight state stores (#327). The Security Model page now covers both binding cookies, the opt-in ValidateRecipient/ValidateInResponseTo checks, and the capacity model; Troubleshooting gains the matching failure modes (HTTP-only deployments, cross-browser callbacks, lost InResponseTo correlation, IdP-initiated logins with ValidateInResponseTo on).
Document provider-disable semantics on the grant paths
Bring the migration status up to date through #390
Sync the Home and Roadmap status notes with the reworked README
Gate the legacy-link migration note behind AllowExistingAccountLink Mirrors the #354 fix into the wiki: the Security Model page gains an upgrade note (the legacy username-keyed migration now honors the AllowExistingAccountLink opt-in, with break-glass and the takeover-window caveat), and the 9p4 migration page's now-false 'migrates automatically, no admin action' line is corrected to point at the flag and the runbook.
Bring the migration status up to date through #353
Sync the Home and Roadmap status with the semi-halted README notice
Add the Architecture page and link it from Home
Document the auth-page CSP and the rate-limiter keying/notice; drop the stale pre-alpha label The Security Model page did not mention the nonce-based Content-Security-Policy the auth page has carried since the response-hardening work, even though the Login Flow page already points at the Response hardening section for it. Describe the policy and what it denies. The rate-limiting section now also covers two behaviors that landed after the last wiki pass: IPv4-in-IPv6 transition sources (NAT64 well-known prefix, 6to4, IPv4-compatible) are keyed on their embedded IPv4 rather than the shared /64, and throttling engagement is summarized in a bounded log notice (one line per minute, count only) so an operator can spot sustained abuse or a pooled-proxy misconfiguration. The migration page still called the project pre-alpha; the maturity ladder names this stage In-Development, so align the warning with the Roadmap wording.
Add a Login Flow page describing both sign-in flows end to end Walk an OpenID Connect and a SAML 2.0 sign-in through the four shared stages (challenge, identity provider, callback validation, session mint), each with a sequence sketch, and cover role mapping, canonical-link account resolution, self-service linking, edge rate limiting, and Quick Connect for non-web clients. Cross-link each validation step to the Security Model rather than restating it, and add the page to the Home Pages list.
Add a Roadmap page with the maturity ladder; sync the Home status to In-Development
Document the PKCE downgrade check, SAML size cap, and state-store bound
Document the hardening merged since the last wiki pass Security Model: RFC 9207 authorization-response issuer check (with the DoNotValidateResponseIssuer escape hatch), the avatar raster content-type allow-list (SVG refused), replay-cache enforcement on the account-linking callback, and SSO revocation via POST /sso/Unregister. Troubleshooting: the 'SSO response validation failed' cause and its per-provider relax.
Security Model: document optional rate limiting and write-only client secret