Provider Google

Provider: Google

Limitations

• Google OIDC uses the sub claim as the username by default. The sub value is a numeric string (e.g., 109876543210987654321), not a human-readable name.
• Google does not support role claims, so RBAC is not available.
• Google uses different endpoint authorities, which requires disabling endpoint validation.

Google Cloud Console Configuration

1. Go to Google Cloud Console → APIs & Services → Credentials.
2. Click Create Credentials → OAuth 2.0 Client ID.
3. Set Application type to Web application.
4. Add the following to Authorized redirect URIs:

   https://<your-jellyfin-domain>/sso/OID/redirect/google
   

5. Copy the Client ID and Client Secret.

Jellyfin Plugin Configuration

Field	Value
Provider Name	google
OpenID Endpoint	https://accounts.google.com
Client ID	from Google Cloud Console
Client Secret	from Google Cloud Console
Do Not Validate OpenID Endpoints	Enabled (required)
Enable Authorization by Plugin	Disabled (no role support)
Enable All Folders	Enabled (recommended)

Username Handling

Since Google usernames are numeric, users will have an unreadable Jellyfin display name. To work around this, you can:

• Set Default Username Claim to email to use the Google email address as the Jellyfin username
• Note that email addresses contain special characters, test that Jellyfin accepts them as usernames

Redirect URI

https://<your-jellyfin-domain>/sso/OID/redirect/google