Home

Warning

🟡 Alpha — for testing and evaluation only

This plugin is at the Alpha stage — the second rung of its maturity ladder (In-Development → Alpha → Beta → Release Candidate → Full Release; see the Roadmap). It is now installable, but for testing and evaluation only — do not put it in front of a real Jellyfin instance with real user accounts, and do not run it in production. This is a login path still being hardened, so you must expect bugs, breaking changes, and security gaps that are still open. Wait for a Full Release before using it anywhere that matters.

Jellyfin SSO Plugin — Wiki

Sign in to Jellyfin through OpenID Connect or SAML 2.0 identity providers.

Status: this is a security-first revival of the archived 9p4/jellyfin-plugin-sso. It continues from the last upstream release (4.0.0.x, Jellyfin 10.11 / .NET 9), taken forward one reviewed change at a time and drawing on its hardened sibling project, jellyfin-plugin-sso-V2 (private). This wiki grows with the plugin — pages describe what is actually implemented today, not planned features. If something here disagrees with the code, the code wins; please open an issue.

Pages

User docs

• Roadmap — the maturity ladder, the current stage, and what each stage gates.
• Installation — install from the plugin catalog, or build from source.
• Migrating from 9p4 — switching from the archived upstream (it is an in-place upgrade).
• Provider Setup — per-identity-provider configuration guides (Authelia, Authentik, Keycloak, Pocket ID, Kanidm, …).
• Troubleshooting — what a specific login rejection means.

Architecture & security

• Login Flow — how an OpenID or SAML sign-in works, end to end.
• Security Model — how the login path fails closed.
• Threat Model — STRIDE model of the AI-assisted delivery pipeline that produces the plugin.
• Architecture — the coding standard and the target architecture the code is converging on.
• Architecture Internals — the as-built code-fact map: concrete types, methods, and file locations of the login flow.

Process & release

• Review Gate — the internal-only merge gate: what it covers, class by class.
• Release Policy — the channel/soak promotion model for shipping a release.
• Release QA Checklist — the manual pre-promotion verification list.
• Rollback — how to contain and reverse a bad release.
• Delivery Metrics — how the four DORA delivery-performance keys are measured.
• OpenSSF Best Practices — the OpenSSF Best Practices badge self-assessment.

Design records

• SSO-Only Login Design — design note for making SSO the sole login path.
• Single Logout Design — design note for SAML/OIDC single logout (SLO).

What it does today

• OpenID Connect and SAML 2.0 sign-in, multiple providers side by side.
• Role-based access: login, administrator, library folders, Live TV.
• A fail-closed login path (see Security Model).
• Avatar sync, Quick Connect support, self-service account linking (/SSOViews/linking).

Reporting security issues

Report vulnerabilities privately via the repository's Report a vulnerability form — not the public issue tracker.