7dc79bf003
SSO login for an existing admin whose token lacked the admin role was silently demoting the account, locking admins out of the dashboard. Missing admin role now leaves the flag alone unless RevokeAdminWithoutRole is enabled. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
78 lines
2.8 KiB
C#
78 lines
2.8 KiB
C#
using MediaBrowser.Model.Plugins;
|
|
|
|
namespace Jellyfin.Plugin.OidcAuth.Configuration;
|
|
|
|
/// <summary>
|
|
/// Plugin configuration for OIDC authentication.
|
|
/// </summary>
|
|
public class PluginConfiguration : BasePluginConfiguration
|
|
{
|
|
/// <summary>
|
|
/// Gets or sets the OIDC issuer URL (authority). Discovery document is fetched from
|
|
/// {issuer}/.well-known/openid-configuration.
|
|
/// </summary>
|
|
public string OidIssuer { get; set; } = string.Empty;
|
|
|
|
/// <summary>
|
|
/// Gets or sets the OIDC client id.
|
|
/// </summary>
|
|
public string OidClientId { get; set; } = string.Empty;
|
|
|
|
/// <summary>
|
|
/// Gets or sets the OIDC client secret.
|
|
/// </summary>
|
|
public string OidClientSecret { get; set; } = string.Empty;
|
|
|
|
/// <summary>
|
|
/// Gets or sets the requested scopes, space separated.
|
|
/// </summary>
|
|
public string OidScopes { get; set; } = "openid profile email";
|
|
|
|
/// <summary>
|
|
/// Gets or sets the claim used as the Jellyfin username.
|
|
/// </summary>
|
|
public string UsernameClaim { get; set; } = "preferred_username";
|
|
|
|
/// <summary>
|
|
/// Gets or sets the claim containing the user's roles/groups.
|
|
/// </summary>
|
|
public string RoleClaim { get; set; } = "groups";
|
|
|
|
/// <summary>
|
|
/// Gets or sets a comma separated list of role/group values that grant Jellyfin
|
|
/// administrator rights. When empty, admin status is never modified by the plugin.
|
|
/// </summary>
|
|
public string AdminRoles { get; set; } = string.Empty;
|
|
|
|
/// <summary>
|
|
/// Gets or sets a comma separated list of role/group values required to log in.
|
|
/// When empty, every authenticated user may log in.
|
|
/// </summary>
|
|
public string AllowedRoles { get; set; } = string.Empty;
|
|
|
|
/// <summary>
|
|
/// Gets or sets a value indicating whether a missing admin role also revokes an
|
|
/// existing administrator flag on OIDC login. Off by default: admin roles only grant.
|
|
/// </summary>
|
|
public bool RevokeAdminWithoutRole { get; set; }
|
|
|
|
/// <summary>
|
|
/// Gets or sets a value indicating whether unknown users are created on first login.
|
|
/// </summary>
|
|
public bool CreateUsersIfMissing { get; set; } = true;
|
|
|
|
/// <summary>
|
|
/// Gets or sets a value indicating whether auto-created users get a random password.
|
|
/// Without one, Jellyfin accepts a blank password for them from any client.
|
|
/// Users can still set their own password in the web profile for TV/native logins,
|
|
/// or use Quick Connect.
|
|
/// </summary>
|
|
public bool SetRandomPasswordOnCreate { get; set; } = true;
|
|
|
|
/// <summary>
|
|
/// Gets or sets a value indicating whether strict discovery endpoint validation is disabled.
|
|
/// Required for providers whose endpoints live on a different host than the issuer (e.g. Google).
|
|
/// </summary>
|
|
public bool DisableEndpointValidation { get; set; }
|
|
}
|