pascallinxweiler/jellyfinsso
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

feat: log OIDC claims and admin mapping, case-insensitive roles

Browse Source 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Pascal Linxweiler
2026-07-13 14:41:24 +02:00
parent fd36fb246b
commit 606f14dfab
4 changed files with 21 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
Jellyfin.Plugin.OidcAuth/Api/OidcAuthController.cs
View File

@@ -101,8 +101,15 @@ public class OidcAuthController : ControllerBase
var roles = result.User.FindAll(Config.RoleClaim).Select(c => c.Value).ToArray(); var roles = result.User.FindAll(Config.RoleClaim).Select(c => c.Value).ToArray();
_logger.LogInformation(
"OIDC login for {Username}. Claims: {Claims}. Roles from claim '{RoleClaim}': [{Roles}]",
username,
string.Join("; ", result.User.Claims.Select(c => $"{c.Type}={c.Value}")),
Config.RoleClaim,
string.Join(", ", roles));
var allowedRoles = SplitCsv(Config.AllowedRoles); var allowedRoles = SplitCsv(Config.AllowedRoles);
if (allowedRoles.Length > 0 && !roles.Intersect(allowedRoles, StringComparer.Ordinal).Any()) if (allowedRoles.Length > 0 && !roles.Intersect(allowedRoles, StringComparer.OrdinalIgnoreCase).Any())
{ {
States.TryRemove(state, out _); States.TryRemove(state, out _);
_logger.LogWarning("OIDC user {Username} denied: no allowed role. Roles: {Roles}", username, string.Join(",", roles)); _logger.LogWarning("OIDC user {Username} denied: no allowed role. Roles: {Roles}", username, string.Join(",", roles));
@@ -136,7 +143,9 @@ public class OidcAuthController : ControllerBase
var adminRoles = SplitCsv(Config.AdminRoles); var adminRoles = SplitCsv(Config.AdminRoles);
if (adminRoles.Length > 0) if (adminRoles.Length > 0)
{ {
user.SetPermission(PermissionKind.IsAdministrator, roles.Intersect(adminRoles, StringComparer.Ordinal).Any()); var isAdmin = roles.Intersect(adminRoles, StringComparer.OrdinalIgnoreCase).Any();
_logger.LogInformation("OIDC admin mapping for {Username}: admin roles [{AdminRoles}] => admin={IsAdmin}", username, Config.AdminRoles, isAdmin);
user.SetPermission(PermissionKind.IsAdministrator, isAdmin);
} }
await _userManager.UpdateUserAsync(user).ConfigureAwait(false); await _userManager.UpdateUserAsync(user).ConfigureAwait(false);

4
Jellyfin.Plugin.OidcAuth/Jellyfin.Plugin.OidcAuth.csproj
View File

@@ -3,8 +3,8 @@
<PropertyGroup> <PropertyGroup>
<TargetFramework>net9.0</TargetFramework> <TargetFramework>net9.0</TargetFramework>
<RootNamespace>Jellyfin.Plugin.OidcAuth</RootNamespace> <RootNamespace>Jellyfin.Plugin.OidcAuth</RootNamespace>
<AssemblyVersion>1.0.1.0</AssemblyVersion> <AssemblyVersion>1.0.2.0</AssemblyVersion>
<FileVersion>1.0.1.0</FileVersion> <FileVersion>1.0.2.0</FileVersion>
<Nullable>enable</Nullable> <Nullable>enable</Nullable>
<ImplicitUsings>disable</ImplicitUsings> <ImplicitUsings>disable</ImplicitUsings>
<CopyLocalLockFileAssemblies>true</CopyLocalLockFileAssemblies> <CopyLocalLockFileAssemblies>true</CopyLocalLockFileAssemblies>

BIN
dist/oidc-auth_1.0.2.0.zip vendored Normal file
View File

Binary file not shown.

8
manifest.json
View File

@@ -7,6 +7,14 @@
"owner": "pascallinxweiler", "owner": "pascallinxweiler",
"category": "Authentication", "category": "Authentication",
"versions": [ "versions": [
{
"version": "1.0.2.0",
"changelog": "Log OIDC claims and admin mapping decisions; role comparison is now case-insensitive.",
"targetAbi": "10.11.0.0",
"sourceUrl": "https://git.linxweiler.xyz/pascallinxweiler/jellyfinplugin/raw/branch/main/dist/oidc-auth_1.0.2.0.zip",
"checksum": "343bcda662a3cdd1e36391222391d2d5",
"timestamp": "2026-07-13T12:30:00Z"
},
{ {
"version": "1.0.1.0", "version": "1.0.1.0",
"changelog": "Rebuilt for Jellyfin 10.11 (net9.0).", "changelog": "Rebuilt for Jellyfin 10.11 (net9.0).",