Change RoleClaim from 'groups' to 'ak_groups' in both fafflix and cheeztv
plugin configs to match Authentik's hierarchical group claim emission.
Add 'ak_groups' to requested scopes in OidScopes list.
Wire phase-1 plugin-based auth into both Jellyfin instances so browser users
sign in via Authentik OIDC (jellyfin-plugin-sso) and native/app-password clients
authenticate through the Authentik LDAP outpost (jellyfin-plugin-ldapauth),
JIT-provisioning users.
Both instances share the single Authentik "jellyfin" OAuth2 client, so the SSO
config is identical; each reads the shared client_secret from its own
namespace-scoped Vault path via a per-namespace VaultStaticSecret.
- plugin-configmap.yaml: SSO-Auth.xml (OID provider "authentik", issuer
identity.k8s.syd1.au.unkin.net/application/o/jellyfin/, EnableAllFolders,
groups-claim role mapping akP-jellyfin-admin->admin / akP-jellyfin-user->user),
LDAP-Auth.xml (server authentik-ldap.authentik.svc:6636 LDAPS,
CreateUsersFromLdap), and branding.xml with a "Sign in with SSO" login link to
/sso/OID/start/authentik.
- statefulset.yaml: inject-plugin-config initContainer renders the XMLs into
/config/plugins/configurations/, substituting client_secret / ldap_bind_password
from the VSO-synced Secret (never committed) before Jellyfin starts.
- vaultstaticsecret.yaml: per-namespace oauth-credentials VSS.
Image tag is intentionally left at v0.1.3; the plugin DLLs land via a separate
jellyfin-ha release and a follow-up pin bump.
unkin-agent