k0lin/jellyfin-plugin-sso

This is a plugin for Jellyfin, a free self-hosted media server that lets you stream your own movies, TV shows, and music to your devices. The plugin adds single sign-on (SSO) support, which means users can log into Jellyfin using accounts they already have with another service, such as Google, Microsoft, or a self-hosted identity provider, rather than creating a separate Jellyfin username and password. The plugin supports two widely used login protocols: OpenID Connect and SAML. These are industry-standard methods that many authentication systems speak, including Authelia, authentik, Keycloak, Pocket ID, Kanidm, and others. Once configured, you can add a login button to the Jellyfin sign-in page that redirects users to their identity provider and brings them back to Jellyfin already logged in. Beyond just logging in, the plugin can authorize users based on their roles or group memberships from the identity provider. For example, you can grant admin access only to users with a specific role, restrict which media libraries a user can see based on their group membership, or block users who do not belong to an approved group from signing in at all. Existing Jellyfin users can link or unlink their SSO accounts themselves through a self-service page. This is a maintained fork of an earlier project that was no longer actively developed. The README describes it as alpha-quality software and notes that the author was learning C# while writing it, so it comes with a caution about production use. Installation is done through Jellyfin's plugin catalog by adding the repository URL in the admin settings. A nightly build is available for testing new features, with the warning that things may change or break between updates. The plugin requires Jellyfin version 10.8 or newer and works on the web interface and any Jellyfin client that supports the Quick Connect feature.