Replies: 1 comment 2 replies
|
Anyone tried upgrading without removing the plugin first? All good? |
2 replies
|
I took the plunge, all good from my end. No need to remove plugin first. Make sure you have backup, of course. |
|
Oh, after a reboot turns out I had both the old version and the new version. This made jellyfin confused. First stop jellyfin container, then step into: Keeping just the latest version |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
After the first release of this fork, I decided to change the versioning scheme for the variants to bring it more in line with the standard. Given that Jellyfin is also changing its versioning scheme, i decided to make this change now. Therefore, from now on, each version will follow the semantic versioning scheme, which uses a three-part version number format: MAJOR.MINOR.PATCH
(Jellyfin will use a different two-digit versioning scheme, but I think it's better to use the standard three-digit scheme for this project)
Jellyfin 12 support
This version targets Jellyfin >= 12.0 and requires it: the plugin is now built on
.NET 10 against the Jellyfin 12.0.0 packages, with
targetAbi 12.0.0.0. If you runJellyfin 10.8 – 10.11, stay on plugin version 5.0.0.0.
default, so the
X-Emby-Authorizationheader was ignored and the linking flow failedwith 401. The linking page and the bundled API client now send the token through the
modern
Authorizationheader, keeping the legacy one for older servers.api_keyquery parameter is replaced byApiKey(the only accepted casing whenlegacy authorization is disabled) throughout the documentation.
Security: SSO accounts can no longer be signed into without SSO
Jellyfin accepts the empty password on the ordinary login form for any account that
has no stored password, so accounts created or linked through SSO were reachable with
just the username. This is now closed in three places, all sharing one password mint:
bytes from the OS CSPRNG) are written as soon as the account exists. If that write
fails, the half-created account is removed again so a failed login cannot leave a
password-less account behind.
the session is created.
SAML) and seals each linked account with no password. It never changes login routing,
never overwrites an existing password, and is idempotent.
When accounts are sealed, the log carries a
[SSO Audit] Sealed N SSO-linked account(s) that had no stored passwordline with a count only. This closes #50.Many thanks to @aslafy-z and everyone who reported this or tried to fix the problem for their help in resolving this issue: the root-cause analysis of the missing password persistence, the fail-closed account creation and the login-time sealing all build on their work in https://github.com/aslafy-z/jellyfin-plugin-sso/pull/1.
New features
administrator from admin roles but will not revoke the administrator flag from an
account that already has it. By default SSO remains the strict source of truth.
OverrideDefaultScopesand
OidAuthorizationParameterslet providers with non-standard flows be configured.EnableContentDownloadingandApplyContentDownloadPermissionOnEveryLogincontrol the download permission in theSSO flow, for new users and optionally on every login.
sync (test(i18n): add translation completeness tests for locale validation #38).
Fixes
UpdateUserAsync, and permission changes go through Jellyfin's user policy path, whichpreserves access schedules and lyric management reliably on current Jellyfin versions (fix: enhance user permission management and error handling in SSOController #15).
Jellyfin's defaults (fix: add enableAuthorization parameter to CreateCanonicalLinkAndUserIfNotExist for improved user policy management #18).
Roles/AdminRolesin provider configurations no longer throw null-referenceexceptions (fix: handle null roles in SSOController to prevent potential errors #16, fix: handle null config roles in SSOController to prevent potential null reference exceptions #17).
Internal
AuthorizationEvaluatorfrom the controller and covered OIDC/SAML RBAC withtests (test: add AuthorizationEvaluator coverage for OIDC and SAML RBAC #26); added tests for the OIDC scope and authorization parameter builders (feat(oidc): add scope overrides and custom authorization parameters #37),
the content download policy (feat(content-download): implement content download permission management in SSO flow #39), and the password sealing (76 tests total).
StateManagernow uses aConcurrentDictionaryfor thread safety (refactor: replace IDictionary with ConcurrentDictionary for StateManager to improve thread safety #27).the CI workflows (modernize CI tooling #21).
What's Changed
New Contributors
Full Changelog: v5.0.0.0...v5.1.0
This discussion was created from the release v5.1.0.
All reactions