Home

Warning

⛔ In-Development — do NOT install this on a production system

This plugin is at the In-Development stage — the first rung of its maturity ladder (In-Development → Alpha → Beta → Release Candidate → Full Release; see the Roadmap). It exists exclusively for developers to test — nothing else. Under no circumstances should it be installed on a production system or put in front of a real Jellyfin instance with real user accounts: it is a login path under active reconstruction, and you must expect breaking changes, incomplete features, and security gaps that are still being closed. Wait for a Full Release before using it anywhere that matters.

Jellyfin SSO Plugin — Wiki

Sign in to Jellyfin through OpenID Connect or SAML 2.0 identity providers.

Status: this is an actively-developed, security-first revival of the archived 9p4/jellyfin-plugin-sso. This wiki grows with the plugin — pages describe what is actually implemented today, not planned features. If something here disagrees with the code, the code wins; please open an issue.

Pages

• Roadmap — the maturity ladder, the current stage, and what each stage gates.
• Installation — build from source and install into Jellyfin.
• Migrating from 9p4 — switching from the archived upstream (it is an in-place upgrade).
• Login Flow — how an OpenID or SAML sign-in works, end to end.
• Security Model — how the login path fails closed.
• Architecture — the coding standard and the target architecture the code is converging on.
• Provider setup — see providers.md in the repo (per-IdP guides).
• Troubleshooting.

What it does today

• OpenID Connect and SAML 2.0 sign-in, multiple providers side by side.
• Role-based access: login, administrator, library folders, Live TV.
• A fail-closed login path (see Security Model).
• Avatar sync, Quick Connect support, self-service account linking (/SSOViews/linking).

Reporting security issues

Report vulnerabilities privately via the repository's Report a vulnerability form — not the public issue tracker.