Provider Keycloak

Provider: Keycloak

Keycloak supports both OpenID Connect and SAML 2.0.

OpenID Connect

Keycloak Client Configuration

1. Go to your realm → Clients → Create client.
2. Set:
   • Client type: OpenID Connect
   • Client ID: jellyfin
3. On the next screen enable Client authentication (makes it confidential).
4. Set Valid redirect URIs:

   https://<your-jellyfin-domain>/sso/OID/redirect/keycloak
   

5. Go to Credentials and copy the Client Secret.

Jellyfin Plugin Configuration

Field	Value
Provider Name	keycloak
OpenID Endpoint	https://<keycloak-domain>/realms/<realm-name>
Client ID	jellyfin
Client Secret	from Keycloak credentials tab
Role Claim	realm_access.roles

For client-specific roles instead of realm roles, use: resource_access.jellyfin.roles

RBAC with Keycloak Realm Roles

1. In Keycloak, go to Realm roles and create roles like jellyfin-user and jellyfin-admin.
2. Assign these roles to users or groups.
3. In the plugin, set:
   • Roles: jellyfin-user
   • Admin Roles: jellyfin-admin
   • Role Claim: realm_access.roles

RBAC with Keycloak Client Roles

1. Go to your client → Roles and create client-level roles.
2. In the plugin set Role Claim to: resource_access.jellyfin.roles

---

SAML 2.0

Keycloak Client Configuration

1. Go to your realm → Clients → Create client.
2. Set Client type to SAML.
3. Set Client ID (Entity ID) to jellyfin.
4. Set Valid redirect URIs (ACS URL):

   https://<your-jellyfin-domain>/sso/SAML/p/keycloak-saml
   

5. Go to Keys and download the Signing certificate.
6. Go to SAML capabilities and ensure Sign documents is enabled and Client signature required is disabled.
7. Add a Role list mapper under Mappers to include roles in assertions:
   • Mapper type: Role list
   • SAML Attribute Name: Role
   • Single Role Attribute: false

Getting the Certificate

In Keycloak → Realm Settings → Keys, find the RS256 signing key and click Certificate to copy it. Remove headers and newlines for the plugin config.

API Configuration

{
  "samlEndpoint": "https://<keycloak-domain>/realms/<realm>/protocol/saml",
  "samlClientId": "jellyfin",
  "samlCertificate": "<base64-cert>",
  "enabled": true,
  "enableAuthorization": true,
  "roles": ["jellyfin-user"],
  "adminRoles": ["jellyfin-admin"]
}

Send to: POST /sso/SAML/Add/keycloak-saml