Home

Note

Status: Beta — the third rung of the maturity ladder (In-Development → Alpha → Beta → Release Candidate → Full Release; see the Roadmap). Installable from the Jellyfin plugin catalog.

Jellyfin SSO Plugin — Wiki

Sign in to Jellyfin through OpenID Connect or SAML 2.0 identity providers.

Status: this is a security-first revival of the archived 9p4/jellyfin-plugin-sso. It continues from the last upstream release (4.0.0.x, Jellyfin 10.11 / .NET 9), taken forward one reviewed change at a time and drawing on its hardened sibling project, jellyfin-plugin-sso-V2 (private). This wiki grows with the plugin — pages describe what is actually implemented today, not planned features. If something here disagrees with the code, the code wins; please open an issue.

Pages

User docs

• Roadmap — the maturity ladder, the current stage, and what each stage gates.
• Installation — install from the plugin catalog, or build from source.
• Migrating from 9p4 — switching from the archived upstream (it is an in-place upgrade).
• Provider Setup — per-identity-provider configuration guides (Authelia, Authentik, Keycloak, Pocket ID, Kanidm, …).
• Troubleshooting — what a specific login rejection means.

Architecture & security

• Login Flow — how an OpenID or SAML sign-in works, end to end.
• Security Model — how the login path fails closed.
• Security Conformance — the ASVS 5.0 + RFC 9700 self-assessment (Met / Partial / N-A, with accepted residuals).
• Threat Model — STRIDE model of the AI-assisted delivery pipeline that produces the plugin.
• Architecture — the coding standard and the target architecture the code is converging on.
• Architecture Internals — the as-built code-fact map: concrete types, methods, and file locations of the login flow.

Process & release

• Review Gate — the internal-only merge gate: what it covers, class by class.
• Release Policy — the channel/soak promotion model for shipping a release.
• Release QA Checklist — the manual pre-promotion verification list.
• Rollback — how to contain and reverse a bad release.
• Delivery Metrics — how the four DORA delivery-performance keys are measured.
• OpenSSF Best Practices — the OpenSSF Best Practices badge self-assessment.
• Maturity Map — an honest Silver/Gold + OSPS-Baseline map, including the criteria a solo AI-assisted project structurally cannot meet.

Design records

• SSO-Only Login Design — the threat model SSO-only login was built to (implemented; the runbook is in Provider Setup).
• Single Logout Design — design note for SAML/OIDC single logout (SLO).
• Native OIDC Coexistence — the documented stance on Jellyfin's upcoming native OIDC (13.0+): complementary, strictly broader, with link-model migration honesty.

What it does today

• OpenID Connect and SAML 2.0 sign-in, multiple providers side by side.
• Role-based access: login, administrator, library folders, Live TV.
• Optional SSO-only login: password login off for every account except a designated break-glass admin (runbook).
• A fail-closed login path (see Security Model).
• Avatar sync, Quick Connect support, self-service account linking (/SSOViews/linking).

Reporting security issues

Report vulnerabilities privately via the repository's Report a vulnerability form — not the public issue tracker.