)
)
Sign in to Jellyfin with your existing identity provider - Keycloak, Authelia, authentik, Entra ID, Google, and more - over OpenID Connect or SAML 2.0, instead of a separate Jellyfin password.
This is a security-first revival of 9p4/jellyfin-plugin-sso, which its original author has since archived. It continues from the last upstream release (4.0.0.x) and now supports both Jellyfin 10.11 (.NET 9) and Jellyfin 12.0 (.NET 10) - one repository URL serves the matching build to each. Huge thanks to the original author and contributors for the foundation.
Development here is AI-assisted - the AI only supports the work, it never takes it over. Claude (Anthropic) assists with individual process steps: it helps me generate and analyse code, helps me run the adversarial security reviews, and translates documentation and comments into English. The coding work stays mine - for every one of those parts the AI only assists, and each step it produces is a proposal, never finished, unreviewed work. I review, understand, edit where needed, and sign off on every one - the AI proposes, I decide, and a human stays responsible for every line that ships, at all times. Nothing lands because a tool suggested it; it lands because I wrote or verified it.
- OpenID Connect and SAML 2.0 - either or both, multiple providers side by side.
- Role-based access control - map identity-provider groups/roles to login, administrator, library folders, Live TV, generic permissions, and a per-group parental-rating ceiling.
- Hardened, fail-closed login path - identities bound to the stable
sub/NameID, fail-closed SAML andid_tokenvalidation, and SSRF-guarded avatar fetches. - Optional SSO-only login - disable password login for every account except a designated break-glass admin, behind a fail-closed last-admin guard.
- Avatar sync, Quick Connect, and self-service account linking. Which client reaches SSO by which mechanism, and what has actually been exercised: Client Compatibility.
- Tested - a growing xUnit suite over the security-critical paths, with CI (build, format, CodeQL) on every change.
How this plugin compares to Jellyfin's built-in auth, the official LDAP plugin, and the archived 9p4 plugin: see the Comparison wiki page.
Any OIDC-conformant or SAML 2.0 identity provider should work. Keycloak, Authelia, authentik, Dex, Pocket ID, Kanidm, Zitadel, and Google have verified, step-by-step guides - with the per-provider caveats - on the Provider Setup wiki page.
The self-hostable providers run in an automated end-to-end login test in CI (e2e-login.yml); cloud providers (Google, Entra ID) can't run in ephemeral CI and are verified manually. A verified guide (or a test) for a provider you use is a welcome contribution.
This is an independent plugin repository - it is not in Jellyfin's built-in catalog. You install it by adding its repository under Plugins → Repositories.
-
In Jellyfin, go to Dashboard → Plugins → Repositories and add this repository URL (one URL serves both Jellyfin 10.11 and 12.0 - your server installs the matching build automatically):
https://raw.githubusercontent.com/Flowfin/jellyfin-plugin-sso/manifest-beta/manifest.json -
Go to Dashboard → Plugins → Catalog, find Community SSO for Jellyfin, and install it.
-
Restart Jellyfin.
This project publishes only to the beta channel for now - a stable channel opens with the first stable release. The plugin GUID is unchanged from the original 9p4 plugin, so it installs over an existing one in place and keeps your configuration. Build-from-source, the release channels, and migrating from the old 9p4 manifest are covered on the Installation wiki page; which clients can complete an SSO sign-in, and by which mechanism, is on Client Compatibility.
Configure your providers on the plugin's settings page (Dashboard → Plugins → SSO-Auth) and via the admin API. The settings page opens on Overview, which reports what each provider's state is and what is left to do; the providers themselves, the linked accounts, the starting-policy profiles and the server-wide switches are on the four tabs beside it. The Provider Setup walkthrough and the Hardening & Options Reference cover every option, the provider-name rules, and the admin-API details. Deployments that keep their configuration in version control can declare providers in a mounted file or in environment variables instead: Config as code covers the document, the variable naming scheme, what wins between the sources, and how a secret is referenced rather than written into the file.
Full documentation lives in the Wiki:
- Installation · Provider Setup · Login Flow · Client Compatibility · Security Model · Troubleshooting
- Building a provisioning tool (Wizarr, jfa-go, a request manager)? The Account-management API page covers creating an account that is SSO-linked before its first login.
- Rebuilding or moving a server? Server migration and rebuild covers the two backup files, the order they have to be restored in, and what is deliberately never restored.
- Monitoring the sign-in path? Metrics covers the counters the plugin publishes, the administrator token the endpoint asks for, and a scrape config to paste.
- Project policies: Governance · Support & security updates · Remediation & secrets policy
The plugin's own served pages are translatable from JSON catalogs, no C# involved. Translating the UI lists the supported languages, the catalog format, and how to add one.
Setup questions ("how do I configure provider X") go to Discussions Q&A, defects to the issue tracker, and vulnerabilities to a private advisory rather than either public channel.
This plugin is built to fail closed by default: a missing signature, a weak signature or under-strength key, an out-of-bounds time window, a wrong audience, a replayed assertion, or an unrecognized identity is rejected rather than waved through. Secrets are stored write-only and AES-256-GCM-encrypted at rest. The controls and their tuning - encryption at rest, optional rate limiting, new-user approval, step-up/MFA passthrough - are on the Security Model wiki page, and security-relevant behavior is covered by the test suite.
Found a vulnerability? Please report it privately via GitHub's "Report a vulnerability" - not the public issue tracker. See SECURITY.md.
Issues and pull requests are welcome. The plugin targets .NET 9 / Jellyfin 10.11 and .NET 10 / Jellyfin 12. Build with dotnet build / dotnet publish and run the tests with dotnet test (the runner needs the .NET 10 SDK). CI builds and tests every change, and the login path goes through an adversarial review. See CONTRIBUTING.md for the workflow.
Built on the Jellyfin LDAP plugin, AspNetSaml (SAML), and the Duende IdentityModel OIDC Client (OpenID Connect) - and on the original 9p4/jellyfin-plugin-sso and its contributors.
Licensed under the GNU GPL v3.0.
See NOTICE.md for the intended-use notice.