OIDC Auth

Base URL of your OIDC provider, e.g. https://auth.example.com. The discovery document is loaded from <issuer>/.well-known/openid-configuration.

Space separated. Default: openid profile email. Add e.g. "groups" if your provider needs it for the role claim.

Claim used as Jellyfin username. Default: preferred_username. Falls back to "sub".

Claim containing groups/roles. Default: groups.

Comma separated. Only users with one of these roles may log in. Empty = everyone.

Comma separated. Users with one of these roles become Jellyfin administrators. Empty = never touch admin flag.

Create users on first login

Set random password for auto-created users (recommended — without it, anyone can log in as them with a blank password)

Disable strict endpoint validation (needed for Google and other providers whose endpoints are on a different host than the issuer)

Login URL: <your jellyfin address>/OidcAuth/login — register <your jellyfin address>/OidcAuth/callback as redirect URI at your provider.