Skip to content

v2.5.14

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Jun 17:25
· 39 commits to main since this release
v2.5.14
29a2cc9

v2.5.14 — 2FA lockout fix, OIDC permissions that actually stick, editable callback URLs

A fix-heavy release that closes a serious 2FA lockout and repairs OIDC permission syncing at the root. In-place upgrade from any 2.5.x — no schema or data migration. The two new options are opt-in, so a default install behaves exactly as 2.5.13.

Fixed

  • 2FA could make Jellyfin Web unreachable (#99, #98). A pending-2FA state was tracked per-browser and, once set, short-circuited every API call — so the app could get stuck showing "server cannot be reached" with no way forward except a server restart, and the same account could work on one device but not another. The injected client now always routes you to the 2FA portal to complete (or recover from) the challenge instead of dead-ending, and the OIDC sign-in bridge clears any stale pending flag before landing you on the app. This is the same per-browser state behind the "OIDC throws me back to login" reports (#98).
  • OIDC role → library access now actually persists (#65). Library grants were being written through an API that does not save user-policy fields on Jellyfin 10.11.x, so the plugin logged the right libraries but the dashboard showed none. Library access is now applied via the same policy API the Jellyfin dashboard uses, and round-trips correctly.
  • IdP group → administrator now actually persists (#96). "Elevate matching users to administrator" had the exact same root cause — the elevation was computed correctly but never saved. It now persists.
  • Template-user permission copy now actually persists (#93). Auto-created OIDC users that copy a template user's permissions were affected by the same bug and silently fell back to Jellyfin defaults; they now inherit the template's policy as intended.
  • The "Two-Factor Authentication" entry returns on non-English UIs (#101). The entry in the user-preferences list was anchored to the English word "Profile", so it went missing on localized installs. It's now located in a language-independent way (and appears for new users and admins, OIDC-enrolled or manual).
  • Missing translations no longer render as raw keys. Any admin-UI label not yet translated in your language now falls back to readable English instead of showing an internal key like tfa.admin.sso.lbl_callback_url.

New

  • Editable callback / redirect URL (#94). You can now rename a provider's callback slug in place — for example to fix a typo'd sing-in-with-… URL — without deleting and re-adding the provider. The provider edit form shows the exact callback URL with a Copy button and an editable Callback slug field; existing SSO links are migrated automatically. After renaming, update the redirect URI at your identity provider to the new URL (the UI tells you what it is).
  • Force a Jellyfin password on OIDC onboarding (#100). An optional per-provider toggle, "Force new users to set a Jellyfin password on first sign-in", sends auto-created OIDC users to a set-password page before normal use — useful for apps and integrations that authenticate against the Jellyfin password. A global policy under Settings controls the minimum strength (length + optional upper/lower/digit requirements; default 16+ characters). Off by default.

Notes

  • #95 (admins linking OIDC from Setup): this release adds a longer link window and clearer diagnostics to pin down the remaining edge case some users still hit; if it still fails for you, the server log now records exactly why.
  • All new admin-UI strings are translated across all 8 languages (en / de / es / fr / it / ja / pt / zh).
  • Supports Jellyfin 10.11.x (10.11.9 and newer). Sigstore-signed + SLSA build-provenance attested.
Assets 8
Loading