From 55137bff29974a5976f35522a98511b21b4eb385 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Wed, 26 Aug 2026 22:35:13 +1000
Subject: [PATCH] Update Jellyfin SSO plugin config for ak_groups claim

Change RoleClaim from 'groups' to 'ak_groups' in both fafflix and cheeztv
plugin configs to match Authentik's hierarchical group claim emission.
Add 'ak_groups' to requested scopes in OidScopes list.
---
 apps/base/cheeztv/plugin-configmap.yaml | 3 ++-
 apps/base/fafflix/plugin-configmap.yaml | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/apps/base/cheeztv/plugin-configmap.yaml b/apps/base/cheeztv/plugin-configmap.yaml
index f5f4856..0b21790 100644
--- a/apps/base/cheeztv/plugin-configmap.yaml
+++ b/apps/base/cheeztv/plugin-configmap.yaml
@@ -47,11 +47,12 @@ data:
               <LiveTvRoles />
               <LiveTvManagementRoles />
               <FolderRoleMappings />
-              <RoleClaim>groups</RoleClaim>
+              <RoleClaim>ak_groups</RoleClaim>
               <OidScopes>
                 <string>openid</string>
                 <string>profile</string>
                 <string>email</string>
+                <string>ak_groups</string>
               </OidScopes>
               <CanonicalLinks></CanonicalLinks>
               <DisableHttps>false</DisableHttps>
diff --git a/apps/base/fafflix/plugin-configmap.yaml b/apps/base/fafflix/plugin-configmap.yaml
index b44fb40..e5b9e19 100644
--- a/apps/base/fafflix/plugin-configmap.yaml
+++ b/apps/base/fafflix/plugin-configmap.yaml
@@ -47,11 +47,12 @@ data:
               <LiveTvRoles />
               <LiveTvManagementRoles />
               <FolderRoleMappings />
-              <RoleClaim>groups</RoleClaim>
+              <RoleClaim>ak_groups</RoleClaim>
               <OidScopes>
                 <string>openid</string>
                 <string>profile</string>
                 <string>email</string>
+                <string>ak_groups</string>
               </OidScopes>
               <CanonicalLinks></CanonicalLinks>
               <DisableHttps>false</DisableHttps>