Skip to content

History

Revisions

  • Add 'Migrating from 9p4' wiki page Document the switch from the archived 9p4/jellyfin-plugin-sso: same plugin GUID, so it is an in-place upgrade that preserves the config; the pre-alpha/test-only caveat; the fail-closed behavior changes an upgrader must check (OIDC asymmetric-signing + sub keying, SAML SHA-1/ DTD/time/audience); and the rollback path. Linked from Home. Refs iderex/jellyfin-plugin-sso#150

    @iderex iderex committed Jul 12, 2026
    bd2ed76

  • Document the OpenID id_token validation The Security Model page now describes the fail-closed id_token checks (JWKS signature under an asymmetric-only allowlist, issuer, audience/azp, lifetime, at_hash), and Troubleshooting gains the matching failure entry (HS256-signed tokens, clock drift, issuer mismatch, missing JWKS). Refs iderex/jellyfin-plugin-sso#134

    @iderex iderex committed Jul 12, 2026
    89b80c6

  • Reflect yesterday's SAML/OIDC hardening in the security docs Security-Model gained the DTD/XXE-billion-laughs prohibition (PR #121), the OpenID state provider-binding and single-use replay guard (PR #56), the defensive response headers on the rendered auth page (PR #124), and the structured audit trail (PR #132) - none were reflected here yet. Troubleshooting's OpenID state lifetime was stale: it said about a minute, but PR #56 raised it to 15 minutes to accommodate provider-side MFA/consent.

    @iderex iderex committed Jul 12, 2026
    887c41c

  • Add the pre-alpha production-use warning to the wiki Home page Mirrors the README warning: pre-alpha, developer testing only, not to be installed on a production system. Refs iderex/jellyfin-plugin-sso#179

    @iderex iderex committed Jul 12, 2026
    a1c008b

  • Merge initial wiki state

    @rekamer rekamer committed Jul 11, 2026
    c64b2f4

  • Initial wiki: Home, Installation, Security Model, Troubleshooting

    @rekamer rekamer committed Jul 11, 2026
    ed6528d

  • Initial Home page

    @iderex iderex committed Jul 11, 2026
    236452f