Home

Warning

⛔ Pre-alpha software — do NOT install this on a production system

This plugin is in pre-alpha. It exists exclusively for developers to test — nothing else. Under no circumstances should it be installed on a production system or put in front of a real Jellyfin instance with real user accounts: it is a login path under active reconstruction, and you must expect breaking changes, incomplete features, and security gaps that are still being closed. Wait for a stable release before using it anywhere that matters.

Jellyfin SSO Plugin — Wiki

Sign in to Jellyfin through OpenID Connect or SAML 2.0 identity providers.

Status: this is an actively-developed, security-first revival of the archived 9p4/jellyfin-plugin-sso. This wiki grows with the plugin — pages describe what is actually implemented today, not planned features. If something here disagrees with the code, the code wins; please open an issue.

Pages

• Installation — build from source and install into Jellyfin.
• Migrating from 9p4 — switching from the archived upstream (it is an in-place upgrade).
• Security Model — how the login path fails closed.
• Provider setup — see providers.md in the repo (per-IdP guides).
• Troubleshooting.

What it does today

• OpenID Connect and SAML 2.0 sign-in, multiple providers side by side.
• Role-based access: login, administrator, library folders, Live TV.
• A fail-closed login path (see Security Model).
• Avatar sync, Quick Connect support, self-service account linking (/SSOViews/linking).

Reporting security issues

Report vulnerabilities privately via the repository's Report a vulnerability form — not the public issue tracker.