fix: #83 Trim whitespace in user provided strings

* feat: allow for HTTPS to be disabled in OpenID discovery (#76)

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,4 @@
+contact_links:
+  - name: Question
+    url: https://github.com/9p4/jellyfin-plugin-sso/discussions
+    about: Please ask and answer questions here.

.github/workflows/build.yml

@@ -0,0 +1,39 @@
+on:
+  workflow_call:
+    inputs:
+      dotnet-version:
+        required: false
+        default: "6.0.x"
+        description: "The .NET version to setup for the build"
+        type: string
+      dotnet-target:
+        required: false
+        default: "net6.0"
+        description: "The .NET target to set for JPRM"
+        type: string
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v2
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v1
+        with:
+          dotnet-version: "${{ inputs.dotnet-version }}"
+
+      - name: Build Jellyfin Plugin
+        uses: oddstr13/jellyfin-plugin-repository-manager@b9e92867a6aa279d611a5ea80cf61f6358838c39
+        id: jprm
+        with:
+          dotnet-target: "${{ inputs.dotnet-target }}"
+
+      - name: Upload Artifact
+        uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # tag=v3
+        with:
+          name: build-artifact
+          retention-days: 30
+          if-no-files-found: error
+          path: ${{ steps.jprm.outputs.artifact }}

.github/workflows/commit-lint.yml

@@ -0,0 +1,11 @@
+name: Lint Commit Messages
+on: [pull_request, push]
+
+jobs:
+  commitlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - uses: wagoid/commitlint-github-action@4caf21aed4a778f940d0b17eb109942ef167bb27

.github/workflows/publish.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   build:
-    uses: jellyfin/jellyfin-meta-plugins/.github/workflows/build.yaml@30fd723cc3bafc4457a4a85be3cdbee2f3e2013b
+    uses: ./.github/workflows/build.yml
     with:
       dotnet-version: "6.0.*"
       dotnet-target:  "net6.0"
@@ -28,11 +28,16 @@ jobs:
           sha256sum ${file#./} >> ${file%.*}.sha256
         done
         ls -l
-    - name: Upload GitHub Release assets
-      uses: shogo82148/actions-upload-release-asset@v1.5.0
+    - name: Publish output artifacts
+      id: publish-assets
+      uses: softprops/action-gh-release@50195ba7f6f93d1ac97ba8332a178e008ad176aa
       with:
-        upload_url: ${{ github.event.release.upload_url }}
-        asset_path: ./*
+          prerelease: false
+          fail_on_unmatched_files: true
+          tag_name:  ${{ github.event.release.tag_name }}
+          files: ./*
+      env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   generate:
     runs-on: ubuntu-latest
     needs:

CONDUCT.md

@@ -0,0 +1,76 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to make participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, sex characteristics, gender identity and expression,
+level of experience, education, socio-economic status, nationality, personal
+appearance, race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+- Using welcoming and inclusive language
+- Being respectful of differing viewpoints and experiences
+- Gracefully accepting constructive criticism
+- Focusing on what is best for the community
+- Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+- The use of sexualized language or imagery and unwelcome sexual attention or
+  advances
+- Trolling, insulting/derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information, such as a physical or electronic
+  address, without explicit permission
+- Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies within all project spaces, and it also applies when
+an individual is representing the project or its community in public spaces.
+Examples of representing a project or community include using an official
+project e-mail address, posting via an official social media account, or acting
+as an appointed representative at an online or offline event. Representation of
+a project may be further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team at [contact@ersei.net](mailto:contact@ersei.net). All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see
+https://www.contributor-covenant.org/faq

CONTRIBUTING.md

@@ -0,0 +1,181 @@
+<!-- omit in toc -->
+
+# Contributing to Jellyfin SSO Plugin
+
+First off, thanks for taking the time to contribute! ❤️
+
+All types of contributions are encouraged and valued. See the [Table of Contents](#table-of-contents) for different ways to help and details about how this project handles them. Please make sure to read the relevant section before making your contribution. It will make it a lot easier for us maintainers and smooth out the experience for all involved. The community looks forward to your contributions. 🎉
+
+> And if you like the project, but just don't have time to contribute, that's fine. There are other easy ways to support the project and show your appreciation, which we would also be very happy about:
+>
+> - Star the project
+> - Tweet about it
+> - Refer this project in your project's readme
+> - Mention the project at local meetups and tell your friends/colleagues
+
+<!-- omit in toc -->
+
+## Table of Contents
+
+- [I Have a Question](#i-have-a-question)
+- [I Want To Contribute](#i-want-to-contribute)
+  - [Reporting Bugs](#reporting-bugs)
+  - [Suggesting Enhancements](#suggesting-enhancements)
+  - [Your First Code Contribution](#your-first-code-contribution)
+  - [Improving The Documentation](#improving-the-documentation)
+- [Styleguides](#styleguides)
+  - [Commit Messages](#commit-messages)
+- [Join The Project Team](#join-the-project-team)
+
+## I Have a Question
+
+> If you want to ask a question, we assume that you have read the available [Documentation](https://github.com/9p4/jellyfin-plugin-sso/blob/main/README.md).
+
+Before you ask a question, it is best to search for existing [Issues](https://github.com/9p4/jellyfin-plugin-sso/issues) that might help you. In case you have found a suitable issue and still need clarification, you can write your question in this issue. It is also advisable to search the internet for answers first.
+
+If you then still feel the need to ask a question and need clarification, we recommend the following:
+
+- Open an [Issue](https://github.com/9p4/jellyfin-plugin-sso/issues/new).
+- Provide as much context as you can about what you're running into.
+- Provide project and platform versions (nodejs, npm, etc), depending on what seems relevant.
+
+We will then take care of the issue as soon as possible.
+
+<!--
+You might want to create a separate issue tag for questions and include it in this description. People should then tag their issues accordingly.
+
+Depending on how large the project is, you may want to outsource the questioning, e.g. to Stack Overflow or Gitter. You may add additional contact and information possibilities:
+- IRC
+- Slack
+- Gitter
+- Stack Overflow tag
+- Blog
+- FAQ
+- Roadmap
+- E-Mail List
+- Forum
+-->
+
+## I Want To Contribute
+
+> ### Legal Notice <!-- omit in toc -->
+>
+> When contributing to this project, you must agree that you have authored 100% of the content, that you have the necessary rights to the content and that the content you contribute may be provided under the project license.
+
+### Reporting Bugs
+
+<!-- omit in toc -->
+
+#### Before Submitting a Bug Report
+
+A good bug report shouldn't leave others needing to chase you up for more information. Therefore, we ask you to investigate carefully, collect information and describe the issue in detail in your report. Please complete the following steps in advance to help us fix any potential bug as fast as possible.
+
+- Make sure that you are using the latest version.
+- Determine if your bug is really a bug and not an error on your side e.g. using incompatible environment components/versions (Make sure that you have read the [documentation](https://github.com/9p4/jellyfin-plugin-sso/blob/main/README.md). If you are looking for support, you might want to check [this section](#i-have-a-question)).
+- To see if other users have experienced (and potentially already solved) the same issue you are having, check if there is not already a bug report existing for your bug or error in the [bug tracker](https://github.com/9p4/jellyfin-plugin-ssoissues?q=label%3Abug).
+- Also make sure to search the internet (including Stack Overflow) to see if users outside of the GitHub community have discussed the issue.
+- Collect information about the bug:
+  - Stack trace (Traceback)
+  - OS, Platform and Version (Windows, Linux, macOS, x86, ARM)
+  - Version of the interpreter, compiler, SDK, runtime environment, package manager, depending on what seems relevant.
+  - Possibly your input and the output
+  - Can you reliably reproduce the issue? And can you also reproduce it with older versions?
+
+<!-- omit in toc -->
+
+#### How Do I Submit a Good Bug Report?
+
+> You must never report security related issues, vulnerabilities or bugs including sensitive information to the issue tracker, or elsewhere in public. Instead sensitive bugs must be sent by email to <contact@ersei.net>.
+
+<!-- You may add a PGP key to allow the messages to be sent encrypted as well. -->
+
+We use GitHub issues to track bugs and errors. If you run into an issue with the project:
+
+- Open an [Issue](https://github.com/9p4/jellyfin-plugin-sso/issues/new). (Since we can't be sure at this point whether it is a bug or not, we ask you not to talk about a bug yet and not to label the issue.)
+- Explain the behavior you would expect and the actual behavior.
+- Please provide as much context as possible and describe the _reproduction steps_ that someone else can follow to recreate the issue on their own. This usually includes your code. For good bug reports you should isolate the problem and create a reduced test case.
+- Provide the information you collected in the previous section.
+
+Once it's filed:
+
+- The project team will label the issue accordingly.
+- A team member will try to reproduce the issue with your provided steps. If there are no reproduction steps or no obvious way to reproduce the issue, the team will ask you for those steps and mark the issue as `needs-repro`. Bugs with the `needs-repro` tag will not be addressed until they are reproduced.
+- If the team is able to reproduce the issue, it will be marked `needs-fix`, as well as possibly other tags (such as `critical`), and the issue will be left to be [implemented by someone](#your-first-code-contribution).
+
+<!-- You might want to create an issue template for bugs and errors that can be used as a guide and that defines the structure of the information to be included. If you do so, reference it here in the description. -->
+
+### Suggesting Enhancements
+
+This section guides you through submitting an enhancement suggestion for Jellyfin SSO Plugin, **including completely new features and minor improvements to existing functionality**. Following these guidelines will help maintainers and the community to understand your suggestion and find related suggestions.
+
+<!-- omit in toc -->
+
+#### Before Submitting an Enhancement
+
+- Make sure that you are using the latest version.
+- Read the [documentation](https://github.com/9p4/jellyfin-plugin-sso/blob/main/README.md) carefully and find out if the functionality is already covered, maybe by an individual configuration.
+- Perform a [search](https://github.com/9p4/jellyfin-plugin-sso/issues) to see if the enhancement has already been suggested. If it has, add a comment to the existing issue instead of opening a new one.
+- Find out whether your idea fits with the scope and aims of the project. It's up to you to make a strong case to convince the project's developers of the merits of this feature. Keep in mind that we want features that will be useful to the majority of our users and not just a small subset. If you're just targeting a minority of users, consider writing an add-on/plugin library.
+
+<!-- omit in toc -->
+
+#### How Do I Submit a Good Enhancement Suggestion?
+
+Enhancement suggestions are tracked as [GitHub issues](https://github.com/9p4/jellyfin-plugin-sso/issues).
+
+- Use a **clear and descriptive title** for the issue to identify the suggestion.
+- Provide a **step-by-step description of the suggested enhancement** in as many details as possible.
+- **Describe the current behavior** and **explain which behavior you expected to see instead** and why. At this point you can also tell which alternatives do not work for you.
+- You may want to **include screenshots and animated GIFs** which help you demonstrate the steps or point out the part which the suggestion is related to. You can use [this tool](https://www.cockos.com/licecap/) to record GIFs on macOS and Windows, and [this tool](https://github.com/colinkeenan/silentcast) or [this tool](https://github.com/GNOME/byzanz) on Linux. <!-- this should only be included if the project has a GUI -->
+- **Explain why this enhancement would be useful** to most Jellyfin SSO Plugin users. You may also want to point out the other projects that solved it better and which could serve as inspiration.
+
+<!-- You might want to create an issue template for enhancement suggestions that can be used as a guide and that defines the structure of the information to be included. If you do so, reference it here in the description. -->
+
+### Your First Code Contribution
+
+<!-- TODO
+include Setup of env, IDE and typical getting started instructions?
+
+-->
+
+The project is built with .NET 6. Download it from [here](https://dotnet.microsoft.com/en-us/download).
+
+Any code editor or IDE with .NET support will work out of the box with this program.
+
+(Some) editors:
+
+- [VSCode](https://code.visualstudio.com/docs/languages/dotnet)
+- [N/Vim](https://github.com/OmniSharp/Omnisharp-vim)
+
+### Improving The Documentation
+
+<!-- TODO
+Updating, improving and correcting the documentation
+
+-->
+
+We are always open to better docs! The main place documentation could be improved is the [providers](https://github.com/9p4/jellyfin-plugin-sso/blob/main/providers.md) documentation. This file keeps track of configurations that are known to work with common SSO providers.
+
+## Styleguides
+
+### Commit Messages
+
+We use [commitlint](https://commitlint.js.org) for linting commit messages.
+
+### C#
+
+We format all C# code according to the .NET formatter. Run `dotnet build .` and fix any warnings that come up.
+
+### HTML/CSS/JS/Markdown
+
+We use [Prettier](https://prettier.io) to format these files.
+
+<!-- TODO
+
+-->
+
+<!-- omit in toc -->
+
+## Attribution
+
+This guide is based on the **contributing-gen**. [Make your own](https://github.com/bttger/contributing-gen)!

README.md

@@ -192,10 +192,12 @@ These all require authorization. Append an API key to the end of the request: `c
   - `enableFolderRoles`: boolean. Determines if role-based folder access should be used.
   - `folderRoleMapping`: object in the format "role": string and "folders": array of strings. The user with this role will have access to the following folders if `enableFolderRoles` is enabled. To get the IDs of the folders, GET the `/Library/MediaFolders` URL with an API key. Look for the `Id` attribute.
   - `roleClaim`: string. This is the value in the OpenID response to check for roles. For Keycloak, it is `realm_access.roles` by default. The first element is the claim type, the subsequent values are to parse the JSON of the claim value. Use a "\\." to denote a literal ".". This expects a list of strings from the OIDC server.
-  - `oidScopes` : array of strings. each containing an additional scope name to include in the OIDC request.
+  - `oidScopes` : array of strings. Each contains an additional scope name to include in the OIDC request.
     - For some OIDC providers (For example, [authelia](https://github.com/9p4/jellyfin-plugin-sso/issues/23#issuecomment-1112237616)), additional scopes may be required in order to validate group membership in role claim.
     - Leave empty to only request the default scopes.
   - `defaultProvider`: string. The set provider then gets assigned to the user after they have logged in. If it is not set, nothing is changed. With this, a user can login with SSO but is still able to log in via other providers later. See the `Unregister` endpoint.
+  - `defaultUsernameClaim`: string. The provider will use the claim to create the users' usernames. If not set, it fallbacks to `preferred_username`.
+  - `requireHttps`: boolean. Determines whether the OpenID discovery endpoint requires HTTP. It is advised NOT to set this to false. If not set, it fallbacks to `true`.
 - GET `OID/Del/PROVIDER_NAME`: This removes a configuration for OpenID for a given provider name.
 - GET `OID/Get`: Lists the configurations currently available.
 - GET `OID/States`: Lists currently active OpenID flows in progress.

SSO-Auth/Api/SSOController.cs

@@ -2,6 +2,7 @@ using System;
 using System.Collections.Generic;
 using System.Linq;
 using System.Net.Mime;
+using System.Security.Cryptography;
 using System.Text.RegularExpressions;
 using System.Threading.Tasks;
 using IdentityModel.OidcClient;
@@ -13,6 +14,7 @@ using MediaBrowser.Controller.Authentication;
 using MediaBrowser.Controller.Library;
 using MediaBrowser.Controller.Net;
 using MediaBrowser.Controller.Session;
+using MediaBrowser.Model.Cryptography;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
@@ -34,6 +36,7 @@ public class SSOController : ControllerBase
     private readonly ISessionManager _sessionManager;
     private readonly IAuthorizationContext _authContext;
     private readonly ILogger<SSOController> _logger;
+    private readonly ICryptoProvider _cryptoProvider;
     private static readonly IDictionary<string, TimedAuthorizeState> StateManager = new Dictionary<string, TimedAuthorizeState>();
 
     /// <summary>
@@ -43,11 +46,13 @@ public class SSOController : ControllerBase
     /// <param name="sessionManager">Instance of the <see cref="ISessionManager"/> interface.</param>
     /// <param name="authContext">Instance of the <see cref="IAuthorizationContext"/> interface.</param>
     /// <param name="userManager">Instance of the <see cref="IUserManager"/> interface.</param>
-    public SSOController(ILogger<SSOController> logger, ISessionManager sessionManager, IUserManager userManager, IAuthorizationContext authContext)
+    /// <param name="cryptoProvider">Instance of the <see cref="ICryptoProvider"/> interface.</param>
+    public SSOController(ILogger<SSOController> logger, ISessionManager sessionManager, IUserManager userManager, IAuthorizationContext authContext, ICryptoProvider cryptoProvider)
     {
         _sessionManager = sessionManager;
         _userManager = userManager;
         _authContext = authContext;
+        _cryptoProvider = cryptoProvider;
         _logger = logger;
         _logger.LogInformation("SSO Controller initialized");
     }
@@ -78,13 +83,14 @@ public class SSOController : ControllerBase
         {
             var options = new OidcClientOptions
             {
-                Authority = config.OidEndpoint,
-                ClientId = config.OidClientId,
-                ClientSecret = config.OidSecret,
+                Authority = config.OidEndpoint.Trim(),
+                ClientId = config.OidClientId.Trim(),
+                ClientSecret = config.OidSecret.Trim(),
                 RedirectUri = GetRequestBase() + "/sso/OID/r/" + provider,
                 Scope = string.Join(" ", config.OidScopes.Prepend("openid profile")),
             };
             options.Policy.Discovery.ValidateEndpoints = false; // For Google and other providers with different endpoints
+            options.Policy.Discovery.RequireHttps = config.RequireHttps || true;
             var oidcClient = new OidcClient(options);
             var currentState = StateManager[state].State;
             var result = oidcClient.ProcessResponseAsync(Request.QueryString.Value, currentState).Result;
@@ -104,7 +110,7 @@ public class SSOController : ControllerBase
 
             foreach (var claim in result.User.Claims)
             {
-                if (claim.Type == "preferred_username")
+                if (claim.Type == (config.DefaultUsernameClaim.Trim() ?? "preferred_username"))
                 {
                     StateManager[state].Username = claim.Value;
                     if (config.Roles.Length == 0)
@@ -116,7 +122,7 @@ public class SSOController : ControllerBase
                 // Role processing
                 // The regex matches any "." not preceded by a "\": a.b.c will be split into a, b, and c, but a.b\.c will be split into a, b.c (after processing the escaped dots)
                 // We have to first process the RoleClaim string
-                string[] segments = Regex.Split(config.RoleClaim, "(?<!\\\\)\\.");
+                string[] segments = Regex.Split(config.RoleClaim.Trim(), "(?<!\\\\)\\.");
                 // Now we make sure that any escaped "."s ("\.") are replaced with "."
                 for (int i = 0; i < segments.Length; i++)
                 {
@@ -176,7 +182,7 @@ public class SSOController : ControllerBase
                         {
                             foreach (FolderRoleMap folderRoleMap in config.FolderRoleMapping)
                             {
-                                if (role.Equals(folderRoleMap.Role))
+                                if (role.Equals(folderRoleMap.Role.Trim()))
                                 {
                                     StateManager[state].Folders.AddRange(folderRoleMap.Folders);
                                 }
@@ -186,7 +192,7 @@ public class SSOController : ControllerBase
                 }
             }
 
-            // If the provider doesn't support preferred_username, then use sub
+            // If the provider doesn't support the preferred username claim, then use the sub claim
             if (!StateManager[state].Valid)
             {
                 foreach (var claim in result.User.Claims)
@@ -249,9 +255,9 @@ public class SSOController : ControllerBase
         {
             var options = new OidcClientOptions
             {
-                Authority = config.OidEndpoint,
-                ClientId = config.OidClientId,
-                ClientSecret = config.OidSecret,
+                Authority = config.OidEndpoint.Trim(),
+                ClientId = config.OidClientId.Trim(),
+                ClientSecret = config.OidSecret.Trim(),
                 RedirectUri = GetRequestBase() + "/sso/OID/r/" + provider,
                 Scope = string.Join(" ", config.OidScopes.Prepend("openid profile")),
             };
@@ -366,7 +372,7 @@ public class SSOController : ControllerBase
                 {
                     Guid userId = await CreateCanonicalLinkAndUserIfNotExist("oid", provider, kvp.Value.Username);
 
-                    var authenticationResult = await Authenticate(userId, kvp.Value.Admin, config.EnableAuthorization, config.EnableAllFolders, kvp.Value.Folders.ToArray(), response, config.DefaultProvider)
+                    var authenticationResult = await Authenticate(userId, kvp.Value.Admin, config.EnableAuthorization, config.EnableAllFolders, kvp.Value.Folders.ToArray(), response, config.DefaultProvider.Trim())
                         .ConfigureAwait(false);
                     return Ok(authenticationResult);
                 }
@@ -464,10 +470,10 @@ public class SSOController : ControllerBase
             }
 
             var request = new AuthRequest(
-                config.SamlClientId,
+                config.SamlClientId.Trim(),
                 GetRequestBase() + "/sso/SAML/p/" + provider);
 
-            return Redirect(request.GetRedirectUrl(config.SamlEndpoint, relayState));
+            return Redirect(request.GetRedirectUrl(config.SamlEndpoint.Trim(), relayState));
         }
 
         throw new ArgumentException("Provider does not exist");
@@ -574,7 +580,7 @@ public class SSOController : ControllerBase
 
             Guid userId = await CreateCanonicalLinkAndUserIfNotExist("saml", provider, samlResponse.GetNameID());
 
-            var authenticationResult = await Authenticate(userId, isAdmin, config.EnableAuthorization, config.EnableAllFolders, folders.ToArray(), response, config.DefaultProvider)
+            var authenticationResult = await Authenticate(userId, isAdmin, config.EnableAuthorization, config.EnableAllFolders, folders.ToArray(), response, config.DefaultProvider.Trim())
                 .ConfigureAwait(false);
             return Ok(authenticationResult);
         }
@@ -624,6 +630,22 @@ public class SSOController : ControllerBase
 
     private async Task<Guid> CreateCanonicalLinkAndUserIfNotExist(string mode, string provider, string canonicalName)
     {
+        User user = null;
+        user = _userManager.GetUserByName(canonicalName);
+        if (user == null)
+        {
+            _logger.LogInformation($"SSO user {canonicalName} doesn't exist, creating...");
+            user = await _userManager.CreateUserAsync(canonicalName).ConfigureAwait(false);
+            user.AuthenticationProviderId = GetType().FullName;
+            // https://jonathancrozier.com/blog/how-to-generate-a-cryptographically-secure-random-string-in-dot-net-with-c-sharp
+            user.Password = _cryptoProvider.CreatePasswordHash(Convert.ToBase64String(RandomNumberGenerator.GetBytes(64))).ToString();
+
+            // Make sure there aren't any trailing existing links
+            var links = GetCanonicalLinks(mode, provider);
+            links.Remove(canonicalName);
+            UpdateCanonicalLinkConfig(links, mode, provider);
+        }
+
         Guid userId = Guid.Empty;
         try
         {
@@ -637,18 +659,7 @@ public class SSOController : ControllerBase
         if (userId == Guid.Empty)
         {
             _logger.LogInformation("SSO user link doesn't exist, creating...");
-            User user = null;
-            user = _userManager.GetUserByName(canonicalName);
-
-            if (user == null)
-            {
-                _logger.LogInformation($"SSO user {canonicalName} doesn't exist, creating...");
-                user = await _userManager.CreateUserAsync(canonicalName).ConfigureAwait(false);
-                user.AuthenticationProviderId = GetType().FullName;
-            }
-
             userId = user.Id;
-
             CreateCanonicalLink(mode, provider, userId, canonicalName);
         }
 
@@ -948,7 +959,19 @@ public class SSOController : ControllerBase
 
     private string GetRequestBase()
     {
-        return Request.Scheme + "://" + Request.Host + Request.PathBase;
+        int requestPort = Request.Host.Port ?? -1;
+        if ((requestPort == 80 && string.Equals(Request.Scheme, "http", StringComparison.OrdinalIgnoreCase)) || (requestPort == 443 && string.Equals(Request.Scheme, "https", StringComparison.OrdinalIgnoreCase)))
+        {
+            requestPort = -1;
+        }
+
+        return new UriBuilder
+        {
+            Scheme = Request.Scheme,
+            Host = Request.Host.Host,
+            Port = requestPort,
+            Path = Request.PathBase
+        }.ToString().TrimEnd('/');
     }
 
     private ContentResult ReturnError(int code, string message)

SSO-Auth/Config/PluginConfiguration.cs

@@ -217,6 +217,16 @@ public class OidConfig
         }
         set => _canonicalLinks = value;
     }
+
+    /// <summary>
+    /// Gets or sets the default username claim when creating new accounts.
+    /// </summary>
+    public string DefaultUsernameClaim { get; set; }
+
+    /// <summary>
+    /// Gets or sets a value indicating whether HTTPS in the discovery endpoint is required.
+    /// </summary>
+    public bool RequireHttps { get; set; }
 }
 
 /// <summary>

SSO-Auth/Config/configPage.html

@@ -437,6 +437,25 @@
                   </div>
                 </div>
 
+                <div class="inputContainer">
+                  <label
+                    class="inputLabel inputLabelUnfocused"
+                    for="DefaultUsernameClaim"
+                    >Set default username claim:</label
+                  >
+                  <input
+                    is="emby-input"
+                    id="DefaultUsernameClaim"
+                    type="text"
+                    class="sso-text"
+                  />
+                  <div class="fieldDescription">
+                    The default username claim to use from OpenID by default. If
+                    it is not set, it defaults to
+                    <code>preferred_username</code>.
+                  </div>
+                </div>
+
                 <button
                   id="SaveProvider"
                   is="emby-button"