feat: add OIDC SSO plugin #1

Merged

ryan.mcgee merged 6 commits from feat/oidc-sso into main

2026-10-16 21:50:38 +00:00

ryan.mcgee commented

2026-10-16 21:50:37 +00:00

Owner

Summary

Adds a Jellyfin 10.11 plugin that signs users in through an OpenID Connect provider (authorization code flow with PKCE).

Changes

Plugin scaffold, pinned SDK Containerfile, provider and user-link configuration with an admin page.
PKCE, discovery, code exchange and id_token validation (signature, iss, aud, lifetime, nonce).
Endpoints start, callback, auth and providers; state bound to a browser cookie against login CSRF.
User provisioning: link by sub, optional create and link-by-username, role mapping to sign-in and admin; created users get a random password.
xUnit tests, README, JPRM build.yaml.

Verification

dotnet build -warnaserror: 0 warnings, 0 errors; dotnet format --verify-no-changes clean.
dotnet test: 24 passed, 0 failed.
Smoke: Jellyfin 10.11.11 plus mock-oauth2-server in podman; login, admin grant and revoke, replay, missing cookie, missing role, name collision, disabled user and empty-password local login all behaved as expected; headless Chromium reached /web/ signed in.

## Summary - Adds a Jellyfin 10.11 plugin that signs users in through an OpenID Connect provider (authorization code flow with PKCE). ## Changes - Plugin scaffold, pinned SDK Containerfile, provider and user-link configuration with an admin page. - PKCE, discovery, code exchange and id_token validation (signature, iss, aud, lifetime, nonce). - Endpoints start, callback, auth and providers; state bound to a browser cookie against login CSRF. - User provisioning: link by sub, optional create and link-by-username, role mapping to sign-in and admin; created users get a random password. - xUnit tests, README, JPRM build.yaml. ## Verification - dotnet build -warnaserror: 0 warnings, 0 errors; dotnet format --verify-no-changes clean. - dotnet test: 24 passed, 0 failed. - Smoke: Jellyfin 10.11.11 plus mock-oauth2-server in podman; login, admin grant and revoke, replay, missing cookie, missing role, name collision, disabled user and empty-password local login all behaved as expected; headless Chromium reached /web/ signed in.

ryan.mcgee added 6 commits

2026-10-16 21:50:37 +00:00

build: scaffold plugin project and config model 3e7521d212

- net9.0 plugin against Jellyfin 10.11.11 with pinned SDK container
- persisted provider and user-link configuration with admin page
- exclude host-provided Microsoft.Extensions.* from output

feat(oidc): add PKCE, discovery and id_token validation 4d92d9ec8a

- single-use expiring store for state and login codes
- discovery, code exchange and JWKS refresh on unknown kid
- validate signature, iss, aud, lifetime (2 min skew) and nonce

feat: add SSO endpoints and user provisioning d0a4d7ca4e

- start, callback, auth and providers endpoints
- state bound to browser cookie to prevent login CSRF
- link users by sub; optional create and link-by-username
- map roles to sign-in and admin; created users get random password

test: cover PKCE, stores, id_token and role mapping e6d331eacb

- RFC 7636 vector, replay and expiry of one-time entries
- id_token rejection cases with a generated RSA key
- role decisions and redirect_uri building

docs: add README and JPRM manifest 1deb084551

chore: merge repository root 3fdd40d9fc

ryan.mcgee merged commit c7c36dc5db into main

2026-10-16 21:50:38 +00:00

ryan.mcgee deleted branch feat/oidc-sso

2026-10-16 21:50:39 +00:00

ryan.mcgee referenced this pull request from a commit

2026-10-16 21:50:39 +00:00

feat: add OIDC SSO plugin (#1)

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Enclave-Information-Systems/jellyfin-sso-plugin!1

No description provided.

Rows
Columns