Authelia SSO doesn't work

[iacchi]

Hello,
I'm trying to implement Authelia OIDC in Jellyfin with your plugin, but with little success. Before I paste the configuration files:

Jellyfin is reachable at https://video.iacchi.casa/jellyfin/
Authelia is reachable at https://login.iacchi.casa/

When I click on the button to login with Authelia I'm correctly redirected to the Authelia login page; I grant access to Jellyfin, and then I get this error in plain text:

Error logging in: Error redeeming code: Unauthorized / Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). -

What am I doing wrong? I think I wrote the configuration as in the examples both here and on Authelia's website.

This is the portion of Authelia's config file related to Jellyfin:

      - client_id: 'jellyfin'
        client_name: 'Jellyfin'
        client_secret: 'redacted'
        public: false
        authorization_policy: 'onefactor_twoadmin'
        require_pkce: true
        pkce_challenge_method: 'S256'
        redirect_uris:
          - 'https://video.iacchi.casa/jellyfin/sso/OID/redirect/authelia'
        scopes:
          - 'openid'
          - 'profile'
          - 'groups'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_post'

The policy "onefactor_twoadmin" is a custom one which works with another client, so this is not the problem.

This is Authelia's user file:

users:
  iacchi:
    disabled: false
    displayname: 'Random Name'
    given_name: 'Random'
    fmaily_name: 'Name'
    nickname: 'iacchi'
    password: 'redacted'
    email: 'random@email.me'
    groups:
      - admins
      - dev

This is the configuration of jellyfin-plugin-sso:

<?xml version="1.0" encoding="utf-8"?>
<PluginConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
  <SamlConfigs />
  <OidConfigs>
    <item>
      <key>
        <string>authelia</string>
      </key>
      <value>
        <PluginConfiguration>
          <OidEndpoint>https://login.iacchi.casa/</OidEndpoint>
          <OidClientId>jellyfin</OidClientId>
          <OidSecret>redacted</OidSecret>
          <Enabled>true</Enabled>
          <EnableAuthorization>true</EnableAuthorization>
          <EnableAllFolders>false</EnableAllFolders>
          <EnabledFolders>
            <string>732de8d8d2910a5c95f79d6692011aa6</string>
            <string>5422e0568d952f014801ce31dacb39b0</string>
            <string>251ed7bf1da91f703ae47a05eaca509e</string>
            <string>253bc9fc2ae4cb0a47d99e75b7e36923</string>
            <string>c0dd427dfcb37370b38d562fe4c21ecd</string>
            <string>06d9cce5c7dd1261c7a0afcdc0eae334</string>
          </EnabledFolders>
          <AdminRoles>
            <string>admins</string>
          </AdminRoles>
          <Roles>
            <string>users</string>
            <string>admins</string>
          </Roles>
          <EnableFolderRoles>false</EnableFolderRoles>
          <EnableLiveTvRoles>false</EnableLiveTvRoles>
          <EnableLiveTv>false</EnableLiveTv>
          <EnableLiveTvManagement>false</EnableLiveTvManagement>
          <LiveTvRoles />
          <LiveTvManagementRoles />
          <FolderRoleMappings />
          <RoleClaim>groups</RoleClaim>
          <OidScopes>
            <string>groups</string>
          </OidScopes>
          <DefaultProvider>Jellyfin.Server.Implementations.Users.DefaultAuthenticationProvider</DefaultProvider>
          <SchemeOverride>https</SchemeOverride>
          <PortOverride xsi:nil="true" />
          <NewPath>true</NewPath>
          <CanonicalLinks />
          <DefaultUsernameClaim>preferred_username</DefaultUsernameClaim>
          <DisableHttps>false</DisableHttps>
          <DisablePushedAuthorization>true</DisablePushedAuthorization>
          <DoNotValidateEndpoints>false</DoNotValidateEndpoints>
          <DoNotValidateIssuerName>false</DoNotValidateIssuerName>
          <DoNotLoadProfile>false</DoNotLoadProfile>
        </PluginConfiguration>
      </value>
    </item>
  </OidConfigs>
</PluginConfiguration>

[iacchi]

To add to what I've written above, after looking better at the documentation in the wiki for this project, I've changed Authelia's configuration related to Jellyfin to this:

      - client_id: 'jellyfin'
        client_name: 'Jellyfin'
        client_secret: 'redacted'
        public: false
        authorization_policy: 'onefactor_twoadmin'
        redirect_uris:
          - 'https://video.iacchi.casa/jellyfin/sso/OID/redirect/authelia'
          - 'org.jellyfin.mobile://login-callback'
        scopes:
          - 'openid'
          - 'profile'
          - 'groups'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_basic'

Note the auth method changed from client_secret_post to client_secret_basic. In the meantime I've also updated Jellyfin to version 12 and the plugin to 5.1.1. With this new configuration I still get an error, which is now:

Error logging in: Error redeeming code: Unauthorized / Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The required credentials were not found, used an unknown method, could not be parsed, were otherwise malformed, or were otherwise incorrect. -

If it can help, the URL for this error is:

https://video.iacchi.casa/jellyfin/sso/OID/redirect/authelia?code=authelia_ac_[long_alphnumeric_string]&iss=https%3A%2F%2Flogin.iacchi.casa&scope=openid+profile+groups&state=[long_alphnumeric_string]