diff --git a/Jellyfin.Plugin.OidcAuth/Api/OidcAuthController.cs b/Jellyfin.Plugin.OidcAuth/Api/OidcAuthController.cs
index f748701..5bbcb87 100644
--- a/Jellyfin.Plugin.OidcAuth/Api/OidcAuthController.cs
+++ b/Jellyfin.Plugin.OidcAuth/Api/OidcAuthController.cs
@@ -101,8 +101,15 @@ public class OidcAuthController : ControllerBase
 
         var roles = result.User.FindAll(Config.RoleClaim).Select(c => c.Value).ToArray();
 
+        _logger.LogInformation(
+            "OIDC login for {Username}. Claims: {Claims}. Roles from claim '{RoleClaim}': [{Roles}]",
+            username,
+            string.Join("; ", result.User.Claims.Select(c => $"{c.Type}={c.Value}")),
+            Config.RoleClaim,
+            string.Join(", ", roles));
+
         var allowedRoles = SplitCsv(Config.AllowedRoles);
-        if (allowedRoles.Length > 0 && !roles.Intersect(allowedRoles, StringComparer.Ordinal).Any())
+        if (allowedRoles.Length > 0 && !roles.Intersect(allowedRoles, StringComparer.OrdinalIgnoreCase).Any())
         {
             States.TryRemove(state, out _);
             _logger.LogWarning("OIDC user {Username} denied: no allowed role. Roles: {Roles}", username, string.Join(",", roles));
@@ -136,7 +143,9 @@ public class OidcAuthController : ControllerBase
         var adminRoles = SplitCsv(Config.AdminRoles);
         if (adminRoles.Length > 0)
         {
-            user.SetPermission(PermissionKind.IsAdministrator, roles.Intersect(adminRoles, StringComparer.Ordinal).Any());
+            var isAdmin = roles.Intersect(adminRoles, StringComparer.OrdinalIgnoreCase).Any();
+            _logger.LogInformation("OIDC admin mapping for {Username}: admin roles [{AdminRoles}] => admin={IsAdmin}", username, Config.AdminRoles, isAdmin);
+            user.SetPermission(PermissionKind.IsAdministrator, isAdmin);
         }
 
         await _userManager.UpdateUserAsync(user).ConfigureAwait(false);
diff --git a/Jellyfin.Plugin.OidcAuth/Jellyfin.Plugin.OidcAuth.csproj b/Jellyfin.Plugin.OidcAuth/Jellyfin.Plugin.OidcAuth.csproj
index e47b883..9b7455a 100644
--- a/Jellyfin.Plugin.OidcAuth/Jellyfin.Plugin.OidcAuth.csproj
+++ b/Jellyfin.Plugin.OidcAuth/Jellyfin.Plugin.OidcAuth.csproj
@@ -3,8 +3,8 @@
   <PropertyGroup>
     <TargetFramework>net9.0</TargetFramework>
     <RootNamespace>Jellyfin.Plugin.OidcAuth</RootNamespace>
-    <AssemblyVersion>1.0.1.0</AssemblyVersion>
-    <FileVersion>1.0.1.0</FileVersion>
+    <AssemblyVersion>1.0.2.0</AssemblyVersion>
+    <FileVersion>1.0.2.0</FileVersion>
     <Nullable>enable</Nullable>
     <ImplicitUsings>disable</ImplicitUsings>
     <CopyLocalLockFileAssemblies>true</CopyLocalLockFileAssemblies>
diff --git a/dist/oidc-auth_1.0.2.0.zip b/dist/oidc-auth_1.0.2.0.zip
new file mode 100644
index 0000000..00fad3d
Binary files /dev/null and b/dist/oidc-auth_1.0.2.0.zip differ
diff --git a/manifest.json b/manifest.json
index 50f6b4b..e5a6894 100644
--- a/manifest.json
+++ b/manifest.json
@@ -7,6 +7,14 @@
         "owner": "pascallinxweiler",
         "category": "Authentication",
         "versions": [
+            {
+                "version": "1.0.2.0",
+                "changelog": "Log OIDC claims and admin mapping decisions; role comparison is now case-insensitive.",
+                "targetAbi": "10.11.0.0",
+                "sourceUrl": "https://git.linxweiler.xyz/pascallinxweiler/jellyfinplugin/raw/branch/main/dist/oidc-auth_1.0.2.0.zip",
+                "checksum": "343bcda662a3cdd1e36391222391d2d5",
+                "timestamp": "2026-07-13T12:30:00Z"
+            },
             {
                 "version": "1.0.1.0",
                 "changelog": "Rebuilt for Jellyfin 10.11 (net9.0).",