pascallinxweiler/jellyfinsso
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix: admin role mapping grants only, revoke behind opt-in

Browse Source 
SSO login for an existing admin whose token lacked the admin role was
silently demoting the account, locking admins out of the dashboard.
Missing admin role now leaves the flag alone unless
RevokeAdminWithoutRole is enabled.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Pascal Linxweiler
2026-07-13 14:44:07 +02:00
parent 606f14dfab
commit 7dc79bf003
8 changed files with 36 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
README.md
View File

@@ -57,7 +57,7 @@ Then in Jellyfin: Dashboard → Plugins → OIDC Auth:
| Username claim | Default `preferred_username`, falls back to `sub` |
| Role claim | Default `groups` |
| Allowed roles | CSV; empty = every authenticated user may log in |
| Admin roles | CSV; empty = plugin never touches the admin flag |
| Admin roles | CSV; users with one of these roles are granted admin on SSO login. Missing role does **not** revoke admin unless "Also revoke admin" is enabled. Empty = plugin never touches the admin flag |
| Create users on first login | On by default; new users get access to all libraries |
| Set random password for auto-created users | On by default. Without it, Jellyfin accepts a **blank password** for these users from any client — convenient on a LAN-only server, dangerous on an exposed one |
| Disable strict endpoint validation | Enable for Google and other providers whose endpoints are on a different host than the issuer |