pascallinxweiler/jellyfinsso
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix: admin role mapping grants only, revoke behind opt-in

Browse Source 
SSO login for an existing admin whose token lacked the admin role was
silently demoting the account, locking admins out of the dashboard.
Missing admin role now leaves the flag alone unless
RevokeAdminWithoutRole is enabled.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Pascal Linxweiler
2026-07-13 14:44:07 +02:00
parent 606f14dfab
commit 7dc79bf003
8 changed files with 36 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
Jellyfin.Plugin.OidcAuth/Api/OidcAuthController.cs
View File

@@ -143,9 +143,16 @@ public class OidcAuthController : ControllerBase
var adminRoles = SplitCsv(Config.AdminRoles);
if (adminRoles.Length > 0)
{
var isAdmin = roles.Intersect(adminRoles, StringComparer.OrdinalIgnoreCase).Any();
_logger.LogInformation("OIDC admin mapping for {Username}: admin roles [{AdminRoles}] => admin={IsAdmin}", username, Config.AdminRoles, isAdmin);
user.SetPermission(PermissionKind.IsAdministrator, isAdmin);
var hasAdminRole = roles.Intersect(adminRoles, StringComparer.OrdinalIgnoreCase).Any();
_logger.LogInformation("OIDC admin mapping for {Username}: admin roles [{AdminRoles}] => hasAdminRole={HasAdminRole}", username, Config.AdminRoles, hasAdminRole);
if (hasAdminRole)
{
user.SetPermission(PermissionKind.IsAdministrator, true);
}
else if (Config.RevokeAdminWithoutRole)
{
user.SetPermission(PermissionKind.IsAdministrator, false);
}
}
await _userManager.UpdateUserAsync(user).ConfigureAwait(false);

6
Jellyfin.Plugin.OidcAuth/Configuration/PluginConfiguration.cs
View File

@@ -50,6 +50,12 @@ public class PluginConfiguration : BasePluginConfiguration
/// </summary>
public string AllowedRoles { get; set; } = string.Empty;
/// <summary>
/// Gets or sets a value indicating whether a missing admin role also revokes an
/// existing administrator flag on OIDC login. Off by default: admin roles only grant.
/// </summary>
public bool RevokeAdminWithoutRole { get; set; }
/// <summary>
/// Gets or sets a value indicating whether unknown users are created on first login.
/// </summary>

9
Jellyfin.Plugin.OidcAuth/Configuration/configPage.html
View File

@@ -51,6 +51,13 @@
<div class="fieldDescription">Comma separated. Users with one of these roles become Jellyfin administrators. Empty = never touch admin flag.</div>
</div>
<div class="checkboxContainer checkboxContainer-withDescription">
<label class="emby-checkbox-label">
<input is="emby-checkbox" id="RevokeAdminWithoutRole" type="checkbox" />
<span>Also revoke admin when the admin role is missing (careful: can demote your existing admin account on SSO login)</span>
</label>
</div>
<div class="checkboxContainer checkboxContainer-withDescription">
<label class="emby-checkbox-label">
<input is="emby-checkbox" id="CreateUsersIfMissing" type="checkbox" />
@@ -90,7 +97,7 @@
(function () {
var pluginId = '96badb44-9940-4ff0-befc-5f987159152c';
var textFields = ['OidIssuer', 'OidClientId', 'OidClientSecret', 'OidScopes', 'UsernameClaim', 'RoleClaim', 'AllowedRoles', 'AdminRoles'];
var boolFields = ['CreateUsersIfMissing', 'SetRandomPasswordOnCreate', 'DisableEndpointValidation'];
var boolFields = ['RevokeAdminWithoutRole', 'CreateUsersIfMissing', 'SetRandomPasswordOnCreate', 'DisableEndpointValidation'];
document.querySelector('#OidcAuthConfigPage').addEventListener('pageshow', function () {
Dashboard.showLoadingMsg();

4
Jellyfin.Plugin.OidcAuth/Jellyfin.Plugin.OidcAuth.csproj
View File

@@ -3,8 +3,8 @@
<PropertyGroup>
<TargetFramework>net9.0</TargetFramework>
<RootNamespace>Jellyfin.Plugin.OidcAuth</RootNamespace>
<AssemblyVersion>1.0.2.0</AssemblyVersion>
<FileVersion>1.0.2.0</FileVersion>
<AssemblyVersion>1.0.3.0</AssemblyVersion>
<FileVersion>1.0.3.0</FileVersion>
<Nullable>enable</Nullable>
<ImplicitUsings>disable</ImplicitUsings>
<CopyLocalLockFileAssemblies>true</CopyLocalLockFileAssemblies>