Pascal Linxweiler
fda59741b5
All checks were successful
Build Plugin / build (push) Successful in 1m1s
Pocket ID exposes an avatar through the standard picture claim, pointing at
/api/users/{id}/profile-picture.png. On login the plugin now fetches that URL
and writes it to the Jellyfin user's profile image, so SSO users get their
avatar without setting one by hand.
The picture is fetched anonymously. The access token is deliberately not sent,
because the address ultimately originates from a token payload and must not be
treated as a trusted destination for credentials. Non-http(s) URLs, non-image
content types and anything over 5 MB are rejected, and an identical image is
not rewritten so the image cache is left alone. Any failure is logged and
swallowed: a broken avatar must never block a login.
Controlled by the new "Sync the profile picture" setting, on by default, with
the claim name configurable for providers that do not use "picture".
Co-Authored-By: Claude <noreply@anthropic.com>
89 lines
3.2 KiB
C#
89 lines
3.2 KiB
C#
using MediaBrowser.Model.Plugins;
|
|
|
|
namespace Jellyfin.Plugin.OidcAuth.Configuration;
|
|
|
|
/// <summary>
|
|
/// Plugin configuration for OIDC authentication.
|
|
/// </summary>
|
|
public class PluginConfiguration : BasePluginConfiguration
|
|
{
|
|
/// <summary>
|
|
/// Gets or sets the OIDC issuer URL (authority). Discovery document is fetched from
|
|
/// {issuer}/.well-known/openid-configuration.
|
|
/// </summary>
|
|
public string OidIssuer { get; set; } = string.Empty;
|
|
|
|
/// <summary>
|
|
/// Gets or sets the OIDC client id.
|
|
/// </summary>
|
|
public string OidClientId { get; set; } = string.Empty;
|
|
|
|
/// <summary>
|
|
/// Gets or sets the OIDC client secret.
|
|
/// </summary>
|
|
public string OidClientSecret { get; set; } = string.Empty;
|
|
|
|
/// <summary>
|
|
/// Gets or sets the requested scopes, space separated.
|
|
/// </summary>
|
|
public string OidScopes { get; set; } = "openid profile email";
|
|
|
|
/// <summary>
|
|
/// Gets or sets the claim used as the Jellyfin username.
|
|
/// </summary>
|
|
public string UsernameClaim { get; set; } = "preferred_username";
|
|
|
|
/// <summary>
|
|
/// Gets or sets the claim containing the user's roles/groups.
|
|
/// </summary>
|
|
public string RoleClaim { get; set; } = "groups";
|
|
|
|
/// <summary>
|
|
/// Gets or sets the claim holding a URL to the user's profile picture.
|
|
/// </summary>
|
|
public string PictureClaim { get; set; } = "picture";
|
|
|
|
/// <summary>
|
|
/// Gets or sets a value indicating whether the Jellyfin profile image is updated
|
|
/// from the picture claim on every OIDC login.
|
|
/// </summary>
|
|
public bool SyncProfilePicture { get; set; } = true;
|
|
|
|
/// <summary>
|
|
/// Gets or sets a comma separated list of role/group values that grant Jellyfin
|
|
/// administrator rights. When empty, admin status is never modified by the plugin.
|
|
/// </summary>
|
|
public string AdminRoles { get; set; } = string.Empty;
|
|
|
|
/// <summary>
|
|
/// Gets or sets a comma separated list of role/group values required to log in.
|
|
/// When empty, every authenticated user may log in.
|
|
/// </summary>
|
|
public string AllowedRoles { get; set; } = string.Empty;
|
|
|
|
/// <summary>
|
|
/// Gets or sets a value indicating whether a missing admin role also revokes an
|
|
/// existing administrator flag on OIDC login. Off by default: admin roles only grant.
|
|
/// </summary>
|
|
public bool RevokeAdminWithoutRole { get; set; }
|
|
|
|
/// <summary>
|
|
/// Gets or sets a value indicating whether unknown users are created on first login.
|
|
/// </summary>
|
|
public bool CreateUsersIfMissing { get; set; } = true;
|
|
|
|
/// <summary>
|
|
/// Gets or sets a value indicating whether auto-created users get a random password.
|
|
/// Without one, Jellyfin accepts a blank password for them from any client.
|
|
/// Users can still set their own password in the web profile for TV/native logins,
|
|
/// or use Quick Connect.
|
|
/// </summary>
|
|
public bool SetRandomPasswordOnCreate { get; set; } = true;
|
|
|
|
/// <summary>
|
|
/// Gets or sets a value indicating whether strict discovery endpoint validation is disabled.
|
|
/// Required for providers whose endpoints live on a different host than the issuer (e.g. Google).
|
|
/// </summary>
|
|
public bool DisableEndpointValidation { get; set; }
|
|
}
|