2380e97e79
OpenID Connect SSO for Jellyfin 10.10 (net8.0). Authorization code flow with PKCE via IdentityModel.OidcClient, automatic user creation with random password, role based admin/access mapping, plugin repo manifest. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
72 lines
2.6 KiB
C#
72 lines
2.6 KiB
C#
using MediaBrowser.Model.Plugins;
|
|
|
|
namespace Jellyfin.Plugin.OidcAuth.Configuration;
|
|
|
|
/// <summary>
|
|
/// Plugin configuration for OIDC authentication.
|
|
/// </summary>
|
|
public class PluginConfiguration : BasePluginConfiguration
|
|
{
|
|
/// <summary>
|
|
/// Gets or sets the OIDC issuer URL (authority). Discovery document is fetched from
|
|
/// {issuer}/.well-known/openid-configuration.
|
|
/// </summary>
|
|
public string OidIssuer { get; set; } = string.Empty;
|
|
|
|
/// <summary>
|
|
/// Gets or sets the OIDC client id.
|
|
/// </summary>
|
|
public string OidClientId { get; set; } = string.Empty;
|
|
|
|
/// <summary>
|
|
/// Gets or sets the OIDC client secret.
|
|
/// </summary>
|
|
public string OidClientSecret { get; set; } = string.Empty;
|
|
|
|
/// <summary>
|
|
/// Gets or sets the requested scopes, space separated.
|
|
/// </summary>
|
|
public string OidScopes { get; set; } = "openid profile email";
|
|
|
|
/// <summary>
|
|
/// Gets or sets the claim used as the Jellyfin username.
|
|
/// </summary>
|
|
public string UsernameClaim { get; set; } = "preferred_username";
|
|
|
|
/// <summary>
|
|
/// Gets or sets the claim containing the user's roles/groups.
|
|
/// </summary>
|
|
public string RoleClaim { get; set; } = "groups";
|
|
|
|
/// <summary>
|
|
/// Gets or sets a comma separated list of role/group values that grant Jellyfin
|
|
/// administrator rights. When empty, admin status is never modified by the plugin.
|
|
/// </summary>
|
|
public string AdminRoles { get; set; } = string.Empty;
|
|
|
|
/// <summary>
|
|
/// Gets or sets a comma separated list of role/group values required to log in.
|
|
/// When empty, every authenticated user may log in.
|
|
/// </summary>
|
|
public string AllowedRoles { get; set; } = string.Empty;
|
|
|
|
/// <summary>
|
|
/// Gets or sets a value indicating whether unknown users are created on first login.
|
|
/// </summary>
|
|
public bool CreateUsersIfMissing { get; set; } = true;
|
|
|
|
/// <summary>
|
|
/// Gets or sets a value indicating whether auto-created users get a random password.
|
|
/// Without one, Jellyfin accepts a blank password for them from any client.
|
|
/// Users can still set their own password in the web profile for TV/native logins,
|
|
/// or use Quick Connect.
|
|
/// </summary>
|
|
public bool SetRandomPasswordOnCreate { get; set; } = true;
|
|
|
|
/// <summary>
|
|
/// Gets or sets a value indicating whether strict discovery endpoint validation is disabled.
|
|
/// Required for providers whose endpoints live on a different host than the issuer (e.g. Google).
|
|
/// </summary>
|
|
public bool DisableEndpointValidation { get; set; }
|
|
}
|