OIDC with Jellyfin SSO Plug-in loop issue

[DAVV3nom]

I have been able to setup Authelia sucessfully and have implmented it as my SSO OIDC with portainer and stirlingPDF, but I am running into issues with Jellyfin.

I have searched for the issue and have found that the issue I was running into was posted at 9p4/jellyfin-plugin-sso#264.

The resolution was to add "https" as a value in the Scheme Override field in for the plug-in.

This worked. When I go to https://jellyfin.example.com/sso/OID/start/authelia, I get redirected to auth.mydomain.com. After verifying however, I get an error in Authelia logs saying

time="2026-02-20T05:09:19Z" level=error msg="Access Request failed with error: Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The request was determined to be using 'token_endpoint_auth_method' method 'client_secret_post', however the OAuth 2.0 client registration does not allow this method. The registered client with id 'jellyfin' is configured to only support 'token_endpoint_auth_method' method 'client_secret_basic'. Either the Authorization Server client registration will need to have the 'token_endpoint_auth_method' updated to 'client_secret_post' or the Relying Party will need to be configured to use 'client_secret_basic'." method=POST path=/api/oidc/token remote_ip=x.x.x.x.x.x

I went back to the configuration.yml and changed the token_endpoint_auth_method to "client_secret_post".

When I go to https://jellyfin.example.com/sso/OID/start/authelia now, I get an error on the page

Error preparing login: Unauthorized - Failed to push authorization parameters

And in Authelia Logs, i now get

time="2026-02-20T05:18:07Z" level=error msg="Pushed Authorization Request failed with error: Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The request was determined to be using 'token_endpoint_auth_method' method 'client_secret_basic', however the OAuth 2.0 client registration does not allow this method. The registered client with id 'jellyfin' is configured to only support 'token_endpoint_auth_method' method 'client_secret_post'. Either the Authorization Server client registration will need to have the 'token_endpoint_auth_method' updated to 'client_secret_basic' or the Relying Party will need to be configured to use 'client_secret_post'." method=POST path=/api/oidc/pushed-authorization-request remote_ip=x.x.x.x.x.x

telling me to switch it back to "client_secret_basic"

Not sure if this is an issue on my end or not.

Below is my Client block from the configuration.yml:

    - client_id: 'jellyfin'
      client_name: 'Jellyfin'
      client_secret: '$argon2id$v=19$......'  # The digest of 'insecure_secret'.
      public: false
      authorization_policy: 'two_factor'
      require_pkce: true
      pkce_challenge_method: 'S256'
      redirect_uris:
        - 'https://jellyfin.default.com/sso/OID/redirect/authelia'
      scopes:
        - 'openid'
        - 'profile'
        - 'groups'
      response_types:
        - 'code'
      grant_types:
        - 'authorization_code'
      access_token_signed_response_alg: 'none'
      userinfo_signed_response_alg: 'none'
      token_endpoint_auth_method: 'client_secret_basic'

I've configured my jellyfin plugin to be exactly as the documentation at https://www.authelia.com/integration/openid-connect/clients/jellyfin/#web-gui with the addtion of the Scheme Override, as again, I was running into the same issue at the beginning of this post.

[Crowley723]

Sounds like #10898 could be the culprit.
Can you try disabling pushed authorization requests in jellyfin?

Also what version of jellyfin are you on?

[Crowley723]

I should note that I have this working with PAR disabled, and the https override.

[DAVV3nom]

Nice! It worked! You are the man! Also I am on 10.11.6.

I was running into issues afterwards but was able to resolve them.

After I authenticate, I get an error saying: "error. Check permissions"

I use LLDAP with Authelia and so I had to go back to LLDAP and create groups for "jellyfin-users" and "jellyfin-admins", and then add my admin user to those groups.

The next issue I ran into was that every time I logged into JellyFin with SSO, my library access would be removed.

That was fixed in the SSO-Auth plugin. There is a setting to enable role based access, or give all access to library if Authenticated with SSO.

For now I just enabled the setting to give all access to the library. Will most likely setup role based later.

But anyways thank you thank you!