unkin-agent
c313c7cc3f
## Summary - Adds SSO-Auth.xml, LDAP-Auth.xml, and branding.xml plugin config (rendered by an initContainer into /config) to fafflix and cheeztv - Adds a per-namespace oauth-credentials VaultStaticSecret to each instance - Adds a "Sign in with SSO" login link via jellyfin branding config ## Why Phase-1 jellyfin auth: browser SSO via the 9p4 SSO plugin (Authentik OIDC, ak_groups claim) and phone/TV app-passwords via the LDAP plugin against the Authentik LDAP outpost. Config is declarative — restarts overwrite UI edits. Activates when the plugin-baked jellyfin-ha image lands (separate PR). Reviewed-on: #424 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
98 lines
4.6 KiB
YAML
98 lines
4.6 KiB
YAML
---
|
|
# Declarative config for the browser-auth plugins bundled in the jellyfin-ha
|
|
# image (jellyfin-plugin-sso, jellyfin-plugin-ldapauth). Rendered into
|
|
# /config/plugins/configurations/ by the inject-plugin-config initContainer,
|
|
# which substitutes the OidSecret / LdapBindPassword placeholders from the
|
|
# VSO-synced oauth-credentials Secret so no secret is committed here. The SSO
|
|
# provider key "authentik" must match the redirect path segment registered on
|
|
# the shared Authentik "jellyfin" OAuth2 client. Roles/AdminRoles are matched
|
|
# against the hierarchical Authentik groups claim (akP-jellyfin-user grants
|
|
# login, akP-jellyfin-admin grants Jellyfin admin; global admins inherit the
|
|
# latter via akR-global-admin).
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: fafflix-plugin-config
|
|
namespace: fafflix
|
|
data:
|
|
SSO-Auth.xml: |
|
|
<?xml version="1.0" encoding="utf-8"?>
|
|
<PluginConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
|
|
<SamlConfigs />
|
|
<OidConfigs>
|
|
<item>
|
|
<key>
|
|
<string>authentik</string>
|
|
</key>
|
|
<value>
|
|
<PluginConfiguration>
|
|
<OidEndpoint>https://identity.k8s.syd1.au.unkin.net/application/o/jellyfin/</OidEndpoint>
|
|
<OidClientId>jellyfin</OidClientId>
|
|
<OidSecret>@@CLIENT_SECRET@@</OidSecret>
|
|
<Enabled>true</Enabled>
|
|
<EnableAuthorization>true</EnableAuthorization>
|
|
<EnableAllFolders>true</EnableAllFolders>
|
|
<EnabledFolders />
|
|
<AdminRoles>
|
|
<string>akP-jellyfin-admin</string>
|
|
</AdminRoles>
|
|
<Roles>
|
|
<string>akP-jellyfin-user</string>
|
|
<string>akP-jellyfin-admin</string>
|
|
</Roles>
|
|
<EnableFolderRoles>false</EnableFolderRoles>
|
|
<EnableLiveTvRoles>false</EnableLiveTvRoles>
|
|
<EnableLiveTv>false</EnableLiveTv>
|
|
<EnableLiveTvManagement>false</EnableLiveTvManagement>
|
|
<LiveTvRoles />
|
|
<LiveTvManagementRoles />
|
|
<FolderRoleMappings />
|
|
<RoleClaim>ak_groups</RoleClaim>
|
|
<OidScopes>
|
|
<string>openid</string>
|
|
<string>profile</string>
|
|
<string>email</string>
|
|
<string>ak_groups</string>
|
|
</OidScopes>
|
|
<CanonicalLinks></CanonicalLinks>
|
|
<DisableHttps>false</DisableHttps>
|
|
<DoNotValidateEndpoints>false</DoNotValidateEndpoints>
|
|
<DoNotValidateIssuerName>false</DoNotValidateIssuerName>
|
|
<SchemeOverride>https</SchemeOverride>
|
|
</PluginConfiguration>
|
|
</value>
|
|
</item>
|
|
</OidConfigs>
|
|
</PluginConfiguration>
|
|
LDAP-Auth.xml: |
|
|
<?xml version="1.0" encoding="utf-8"?>
|
|
<PluginConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
|
|
<LdapServer>authentik-ldap.authentik.svc.cluster.local</LdapServer>
|
|
<LdapPort>6636</LdapPort>
|
|
<UseSsl>true</UseSsl>
|
|
<UseStartTls>false</UseStartTls>
|
|
<SkipSslVerify>true</SkipSslVerify>
|
|
<LdapBindUser>cn=jellyfin-ldap,ou=users,DC=ldap,DC=goauthentik,DC=io</LdapBindUser>
|
|
<LdapBindPassword>@@LDAP_BIND_PASSWORD@@</LdapBindPassword>
|
|
<LdapBaseDn>ou=users,DC=ldap,DC=goauthentik,DC=io</LdapBaseDn>
|
|
<LdapSearchFilter>(objectClass=user)</LdapSearchFilter>
|
|
<LdapAdminBaseDn>ou=users,DC=ldap,DC=goauthentik,DC=io</LdapAdminBaseDn>
|
|
<LdapAdminFilter>(memberOf=cn=akP-jellyfin-admin,ou=groups,DC=ldap,DC=goauthentik,DC=io)</LdapAdminFilter>
|
|
<EnableLdapAdminFilterMemberUid>false</EnableLdapAdminFilterMemberUid>
|
|
<LdapSearchAttributes>uid, cn, mail, displayName</LdapSearchAttributes>
|
|
<CreateUsersFromLdap>true</CreateUsersFromLdap>
|
|
<AllowPassChange>false</AllowPassChange>
|
|
<LdapUidAttribute>cn</LdapUidAttribute>
|
|
<LdapUsernameAttribute>cn</LdapUsernameAttribute>
|
|
<LdapPasswordAttribute>userPassword</LdapPasswordAttribute>
|
|
<EnableAllFolders>true</EnableAllFolders>
|
|
<EnabledFolders />
|
|
</PluginConfiguration>
|
|
branding.xml: |
|
|
<?xml version="1.0" encoding="utf-8"?>
|
|
<BrandingOptions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
|
|
<LoginDisclaimer><p style="text-align:center"><a href="/sso/OID/start/authentik">Sign in with SSO</a></p></LoginDisclaimer>
|
|
<CustomCss></CustomCss>
|
|
<SplashscreenEnabled>false</SplashscreenEnabled>
|
|
</BrandingOptions>
|