Provider Authelia

Provider: Authelia

Prerequisites

• Authelia running and accessible
• A Jellyfin OIDC client configured in Authelia

Authelia Client Configuration

In your Authelia configuration (configuration.yml), add a new OIDC client:

identity_providers:
  oidc:
    clients:
      - client_id: jellyfin
        client_name: Jellyfin
        client_secret: '<your-secret-hash>'
        public: false
        authorization_policy: one_factor
        redirect_uris:
          - https://<your-jellyfin-domain>/sso/OID/redirect/authelia
        scopes:
          - openid
          - profile
          - groups
        userinfo_signed_response_alg: none
        token_endpoint_auth_method: client_secret_basic

Generate a secret hash with: authelia crypto hash generate pbkdf2 --variant sha512

Jellyfin Plugin Configuration

Field	Value
Provider Name	authelia
OpenID Endpoint	https://<authelia-domain>
Client ID	jellyfin
Client Secret	your plain-text secret
Role Claim	groups
Request Additional Scopes	groups
Disable Pushed Authorization	Enabled (required)

Authelia does not support Pushed Authorization Requests (PAR). You must enable Disable Pushed Authorization in the security-sensitive options.

RBAC Configuration

Set Roles to the Authelia group names that are allowed to log in:

jellyfin

Set Admin Roles to groups that should receive admin access:

jellyfin-admins

Redirect URI

https://<your-jellyfin-domain>/sso/OID/redirect/authelia