Merge pull request 'publish the plugin zip to artifactapi on tag' (#4 ) from benvin/release-pipeline into main

Reviewed-on: #4
Merge remote-tracking branch 'origin/main' into benvin/release-pipeline
2026-09-19 23:52:47 +10:00 · 2026-09-19 23:45:15 +10:00 · 2026-09-19 23:43:50 +10:00 · 2026-09-19 23:38:48 +10:00 · 2026-09-19 23:37:18 +10:00 · 2026-09-19 23:23:26 +10:00
41 changed files with 2445 additions and 366 deletions
@@ -1,13 +0,0 @@
-# These are supported funding model platforms
-
-github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
-patreon: # Replace with a single Patreon username
-open_collective: # Replace with a single Open Collective username
-ko_fi: # Replace with a single Ko-fi username
-tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
-community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
-liberapay: a055
-issuehunt: # Replace with a single IssueHunt username
-otechie: # Replace with a single Otechie username
-lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
-custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']
@@ -3,12 +3,12 @@ on:
    inputs:
      dotnet-version:
        required: false
-        default: "6.0.x"
+        default: "9.0.x"
        description: "The .NET version to setup for the build"
        type: string
      dotnet-target:
        required: false
-        default: "net6.0"
+        default: "net9.0"
        description: "The .NET target to set for JPRM"
        type: string

@@ -25,15 +25,15 @@ jobs:
          dotnet-version: "${{ inputs.dotnet-version }}"

      - name: Build Jellyfin Plugin
-        uses: oddstr13/jellyfin-plugin-repository-manager@b9e92867a6aa279d611a5ea80cf61f6358838c39
+        uses: oddstr13/jellyfin-plugin-repository-manager@9497a0a499416cc572ed2e07a391d9f943a37b4d # v1.1.1
        id: jprm
        with:
          dotnet-target: "${{ inputs.dotnet-target }}"

      - name: Upload Artifact
-        uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # tag=v3
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # tag=v4.6.2
        with:
          name: build-artifact
          retention-days: 30
          if-no-files-found: error
-          path: ${{ steps.jprm.outputs.artifact }}
+          path: ${{ steps.jprm.outputs.artifact }}
@@ -1,11 +0,0 @@
-name: Lint Commit Messages
-on: [pull_request, push]
-
-jobs:
-  commitlint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-      - uses: wagoid/commitlint-github-action@4caf21aed4a778f940d0b17eb109942ef167bb27
@@ -16,7 +16,7 @@ jobs:
    - name: Setup .NET
      uses: actions/setup-dotnet@v1
      with:
-        dotnet-version: 6.0.x
+        dotnet-version: 9.0.x
    - name: Restore dependencies
      run: dotnet restore
    - name: Build
@@ -15,7 +15,7 @@ jobs:
    - name: Setup .NET
      uses: actions/setup-dotnet@v1
      with:
-        dotnet-version: 6.0.x
+        dotnet-version: 9.0.x
    - name: Restore dependencies
      run: dotnet restore
    - name: Build Dotnet
@@ -30,12 +30,12 @@ jobs:
        updateFile: true
    - name: "JPRM: Build"
      id: jrpm
-      uses: oddstr13/jellyfin-plugin-repository-manager@b9e92867a6aa279d611a5ea80cf61f6358838c39
+      uses: oddstr13/jellyfin-plugin-repository-manager@9497a0a499416cc572ed2e07a391d9f943a37b4d # v1.1.1
      with:
        version: "0.0.0.9000"
        verbosity: debug
        path: .
-        dotnet-target: "net6.0"
+        dotnet-target: "net9.0"
        output: _dist
    - name: Prepare GitHub Release assets
      run: |-
@@ -10,15 +10,15 @@ jobs:
  build:
    uses: ./.github/workflows/build.yml
    with:
-      dotnet-version: "6.0.*"
-      dotnet-target:  "net6.0"
+      dotnet-version: "9.0.*"
+      dotnet-target:  "net9.0"
  upload:
    runs-on: ubuntu-latest
    needs:
    - build
    steps:
    - name: Download Artifact
-      uses: actions/download-artifact@v2.1.0
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
      with:
        name: build-artifact
    - name: Prepare GitHub Release assets
@@ -0,0 +1,26 @@
+when:
+  - event: pull_request
+
+steps:
+  # Restore, build and test in one step so the NuGet cache stays on the step's
+  # own ephemeral storage instead of the workspace volume.
+  - name: build-test
+    image: mcr.microsoft.com/dotnet/sdk:10.0
+    environment:
+      DOTNET_CLI_TELEMETRY_OPTOUT: "1"
+      DOTNET_NOLOGO: "1"
+    commands:
+      - dotnet --info
+      - dotnet restore SSO-Auth.sln
+      - dotnet build SSO-Auth.sln -c Release --no-restore --warnaserror
+      - dotnet test SSO-Auth.sln -c Release --no-build --verbosity minimal
+    backend_options:
+      kubernetes:
+        serviceAccountName: jellyfin-plugin-sso
+        resources:
+          requests:
+            memory: 1Gi
+            cpu: 1
+          limits:
+            memory: 4Gi
+            cpu: 2
@@ -0,0 +1,74 @@
+when:
+  - event: tag
+    ref: refs/tags/v*
+
+steps:
+  # Everything runs on almalinux9-base: JPRM installs from the artifactapi pypi
+  # remote and the publish below PUTs to artifactapi, both over https against
+  # the internal CA. The Microsoft SDK image does not trust that CA (curl 60),
+  # so the dotnet build has to come to the image that does rather than the
+  # other way round.
+  - name: package
+    image: git.unkin.net/unkin/almalinux9-base:20260606
+    environment:
+      DOTNET_CLI_TELEMETRY_OPTOUT: "1"
+      DOTNET_NOLOGO: "1"
+    commands:
+      - |
+        set -eu
+        VERSION=$$(sed -n 's/^version: *"\([0-9.]*\)".*/\1/p' build.yaml | head -1)
+        if [ "v$$VERSION" != "$$CI_COMMIT_TAG" ]; then
+          echo "tag $$CI_COMMIT_TAG does not match build.yaml version $$VERSION; use make patch/minor/major/hotfix"
+          exit 1
+        fi
+        dnf -y -q install dotnet-sdk-10.0 python3-pip zip
+        pip3 install --quiet --index-url https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/pypi/simple "jprm==1.1.0"
+        mkdir -p dist
+        jprm plugin build . --output ./dist --version "$$VERSION" --dotnet-configuration Release --dotnet-framework net10.0
+        ls -l dist
+    backend_options:
+      kubernetes:
+        serviceAccountName: jellyfin-plugin-sso
+        resources:
+          requests:
+            memory: 2Gi
+            cpu: 1
+          limits:
+            memory: 4Gi
+            cpu: 2
+
+  # Uploads are immutable (409 on overwrite) and artifactapi has no HEAD route,
+  # so probe with GET and treat an existing object as a no-op re-run.
+  - name: publish
+    image: git.unkin.net/unkin/almalinux9-base:20260606
+    commands:
+      - |
+        set -eu
+        HOST="https://artifactapi.k8s.syd1.au.unkin.net"
+        REPO="jellyfin-plugins"
+        ZIP=$$(ls dist/sso-authentication_*.zip | head -1)
+        VERSION=$$(echo "$$CI_COMMIT_TAG" | sed 's/^v//')
+        PATH_IN_REPO="unkin/jellyfin-plugin-sso/$$VERSION/$$(basename "$$ZIP")"
+        code=$$(curl -s -o /dev/null -w '%{http_code}' "$$HOST/api/v2/remotes/$$REPO/files/$$PATH_IN_REPO" || true)
+        if [ "$$code" = "200" ]; then
+          echo "$$PATH_IN_REPO already published (HTTP $$code); skipping upload"
+          exit 0
+        fi
+        echo "Uploading $$ZIP to $$REPO/$$PATH_IN_REPO (existence probe returned $$code)"
+        curl -f -X PUT \
+          "$$HOST/api/v2/remotes/$$REPO/files/$$PATH_IN_REPO" \
+          -H "Content-Type: application/zip" \
+          --data-binary @"$$ZIP"
+        echo
+        sha256sum "$$ZIP"
+    depends_on: [package]
+    backend_options:
+      kubernetes:
+        serviceAccountName: jellyfin-plugin-sso
+        resources:
+          requests:
+            memory: 256Mi
+            cpu: 250m
+          limits:
+            memory: 1Gi
+            cpu: 1
@@ -0,0 +1,51 @@
+.PHONY: build test lint clean patch minor major hotfix
+
+SLN ?= SSO-Auth.sln
+
+build:
+	dotnet restore $(SLN)
+	dotnet build $(SLN) -c Release --no-restore --warnaserror
+
+test: build
+	dotnet test $(SLN) -c Release --no-build --verbosity minimal
+
+lint:
+	dotnet format $(SLN) --verify-no-changes
+
+clean:
+	dotnet clean $(SLN) -c Release || true
+	rm -rf SSO-Auth/bin SSO-Auth/obj tests/SSO-Auth.Tests/bin tests/SSO-Auth.Tests/obj
+
+# Jellyfin plugin versions are 4-part (System.Version in the plugin manifest),
+# so build.yaml holds the version and the release tag must be exactly
+# v<that version>; .woodpecker/release.yaml fails the build if they diverge.
+_CUR := $(shell sed -n 's/^version: *"\([0-9.]*\)".*/\1/p' build.yaml | head -1)
+_A   := $(or $(word 1,$(subst ., ,$(_CUR))),0)
+_B   := $(or $(word 2,$(subst ., ,$(_CUR))),0)
+_C   := $(or $(word 3,$(subst ., ,$(_CUR))),0)
+_D   := $(or $(word 4,$(subst ., ,$(_CUR))),0)
+
+define release
+	@test -n "$(_CUR)" || { echo "cannot parse version from build.yaml"; exit 1; }
+	@test -z "$$(git status --porcelain)" || { echo "working tree is dirty"; exit 1; }
+	@sed -i 's|^version: .*|version: "$(1)"|' build.yaml
+	@sed -i 's|<AssemblyVersion>[^<]*</AssemblyVersion>|<AssemblyVersion>$(1)</AssemblyVersion>|' SSO-Auth/SSO-Auth.csproj
+	@sed -i 's|<FileVersion>[^<]*</FileVersion>|<FileVersion>$(1)</FileVersion>|' SSO-Auth/SSO-Auth.csproj
+	@git commit -qam "release $(1)"
+	@git tag v$(1)
+	@git push origin HEAD v$(1)
+	@echo "Released v$(1)"
+endef
+
+major:
+	$(call release,$(shell expr $(_A) + 1).0.0.0)
+
+minor:
+	$(call release,$(_A).$(shell expr $(_B) + 1).0.0)
+
+patch:
+	$(call release,$(_A).$(_B).$(shell expr $(_C) + 1).0)
+
+# Fourth component: a rebuild of an existing patch (upstream's 3.5.2.1 shape).
+hotfix:
+	$(call release,$(_A).$(_B).$(_C).$(shell expr $(_D) + 1))
@@ -22,6 +22,8 @@
 </a>
 </p>

+Project archived because I'm tired of working on this after all the years.
+
 This plugin allows users to sign in through an SSO provider (such as Google, Microsoft, or your own provider). This enables one-click signin.

 https://user-images.githubusercontent.com/17993169/149681516-f93b43f5-fa5c-4c1f-a909-e5414878a864.mp4
@@ -34,7 +36,7 @@ This is 100% alpha software! PRs are welcome to improve the code.

 ~~There is NO admin configuration! You must use the API to configure the program!~~ Added by [strazto](https://github.com/strazto) in PR [#18](https://github.com/9p4/jellyfin-plugin-sso/pull/18) and [#27](https://github.com/9p4/jellyfin-plugin-sso/pull/27).

-**[This is for Jellyfin 10.8](https://github.com/9p4/jellyfin-plugin-sso/issues/3) and only on the Web UI!**
+**[This is for Jellyfin >=10.8](https://github.com/9p4/jellyfin-plugin-sso/issues/3) and only on the Web UI or clients supporting [Quick Connect](https://jellyfin.org/docs/general/server/quick-connect)**

 **This README reflects the branch it is currently on! Switch tags to view version-specific documentation!**

@@ -46,11 +48,13 @@ This is 100% alpha software! PRs are welcome to improve the code.
 - authentik
 - Keycloak
  - OIDC & SAML
+- Pocket ID
+- Kanidm
 - Google OpenID: Works, but usernames are all numeric

 ## Supported Protocols

- [OpenID](https://openid.net/what-is-openid/)
+- [OpenID](https://openid.net/developers/how-connect-works/)
 - [SAML](https://www.cloudflare.com/learning/access-management/what-is-saml/)

 ## Security
@@ -91,6 +95,35 @@ The nightly build may have new features unavailable in other builds, but **be wa

 ## Examples

+### Creating A Login Button On The Main Page
+
+In the Jellyfin administration UI, under "General", there is a "Branding" section. In that section, add the following code in the "Login disclaimer" block (replacing `PROVIDER_NAME` and the domain):
+
+```html
+<form action="https://jellyfin.example.com/sso/OID/start/PROVIDER_NAME">
+  <button class="raised block emby-button button-submit">
+    Sign in with SSO
+  </button>
+</form>
+```
+
+Then, add the following code in the "Custom CSS code" section:
+
+```css
+a.raised.emby-button {
+  padding: 0.9em 1em;
+  color: inherit !important;
+}
+
+.disclaimerContainer {
+  display: block;
+}
+```
+
+![screenshot of the configuration page with the same code](img/custom-button.png)
+
+For more information, refer to [issue #16](https://github.com/9p4/jellyfin-plugin-sso/issues/16).
+
 ### SAML

 Example for adding a SAML configuration with the API using [curl](https://curl.se/):
@@ -104,9 +137,9 @@ The SAML provider must have the following configuration (I am using Keycloak, an
 - Sign Documents on
 - Sign Assertions off
 - Client Signature Required off
- Redirect URI: [https://myjellyfin.example.com/sso/SAML/p/PROVIDER_NAME](https://myjellyfin.example.com/sso/OID/p/PROVIDER_NAME)
+- Redirect URI: [https://myjellyfin.example.com/sso/SAML/post/PROVIDER_NAME](https://myjellyfin.example.com/sso/SAML/start/PROVIDER_NAME)
 - Base URL: [https://myjellyfin.example.com](https://myjellyfin.example.com)
- Master SAML processing URL: [https://myjellyfin.example.com/sso/SAML/p/PROVIDER_NAME](https://myjellyfin.example.com/sso/SAML/p/PROVIDER_NAME)
+- Master SAML processing URL: [https://myjellyfin.example.com/sso/SAML/start/PROVIDER_NAME](https://myjellyfin.example.com/sso/SAML/start/PROVIDER_NAME)

 Make sure that `clientid` is replaced with the actual client ID and `PROVIDER_NAME` is replaced with the chosen provider name!

@@ -120,7 +153,7 @@ The OpenID provider must have the following configuration (again, I am using Key

 - Access Type: Confidential
 - Standard Flow Enabled
- Redirect URI: [https://myjellyfin.example.com/sso/OID/r/PROVIDER_NAME](https://myjellyfin.example.com/sso/OID/r/PROVIDER_NAME)
+- Redirect URI: [https://myjellyfin.example.com/sso/OID/redirect/PROVIDER_NAME](https://myjellyfin.example.com/sso/OID/redirect/PROVIDER_NAME)
 - Base URL: [https://myjellyfin.example.com](https://myjellyfin.example.com)

 Make sure that `clientid` is replaced with the actual client ID and `PROVIDER_NAME` is replaced with the chosen provider name!
@@ -133,8 +166,8 @@ The API is all done from a base URL of `/sso/`

 #### Flow

- POST `SAML/p/PROVIDER_NAME`: This is the SAML POST endpoint. It accepts a form response from the SAML provider and returns HTML and JavaScript for the client to login with a given provider name.
- GET `SAML/p/PROVIDER_NAME`: This is the SAML initiator: it will begin the authorization flow for SAML with a given provider name.
+- POST `SAML/start/PROVIDER_NAME`: This is the SAML POST endpoint. It accepts a form response from the SAML provider and returns HTML and JavaScript for the client to login with a given provider name.
+- GET `SAML/start/PROVIDER_NAME`: This is the SAML initiator: it will begin the authorization flow for SAML with a given provider name.
 - POST `SAML/Auth/PROVIDER_NAME`: This is the SAML client-side API: the HTML and JavaScript client will call this endpoint to receive Jellyfin credentials given a provider name. Post format is in JSON with the following keys:
  - `deviceId`: string. Device ID.
  - `deviceName`: string. Device name.
@@ -151,7 +184,7 @@ These all require authorization. Append an API key to the end of the request: `c
  - `samlClientId`: string. The SAML client ID.
  - `samlCertificate`: string. The base64 encoded SAML certificate.
  - `enabled`: boolean. Determines if the provider is enabled or not.
-  - `enableAuthorization`: boolean: Determines if the plugin sets permissions for the user. If false, the user will start with no permissions and an administrator will add permissions. The permissions of existing users will not be rewritten on subsequent logins.
+  - `enableAuthorization`: boolean: Determines if the plugin sets permissions for the user. If false, the user will start with no permissions and an administrator will add permissions. If disabled, then the permissions of users will not be modified and the Jellyfin defaults will be used instead.
  - `enableAllFolders`: boolean. Determines if the client logging in is allowed access to all folders.
  - `enabledFolders`: array of strings. If `enableAllFolders` is set to false, then this will be used to determine what folders the users who log in through this provider are allowed to use.
  - `roles`: array of strings. This validates the SAML response against the `Role` attribute. If a user has any of these roles, then the user is authenticated. Leave blank to disable role checking.
@@ -164,6 +197,7 @@ These all require authorization. Append an API key to the end of the request: `c
  - `enableLiveTv`: boolean. Whether to allow Live TV by default. This applies even if `enableLiveTvRoles` is enabled.
  - `enableLiveTvManagement`: boolean. Whether to allow Live TV management by default. This applies even if `enableLiveTvRoles` is enabled.
  - `defaultProvider`: string. The set provider then gets assigned to the user after they have logged in. If it is not set, nothing is changed. With this, a user can login with SSO but is still able to log in via other providers later. See the `Unregister` endpoint.
+  - `schemeOverride`: string. Sets the scheme for URLs used. Can be useful if the plugin refuses to use HTTPS URLs.
 - GET `SAML/Del/PROVIDER_NAME`: This removes a configuration for SAML for a given provider name.
 - GET `SAML/Get`: Lists the configurations currently available.

@@ -171,8 +205,8 @@ These all require authorization. Append an API key to the end of the request: `c

 #### Flow

- GET `OID/r/PROVIDER_NAME`: This is the OpenID callback path. This will return HTML and JavaScript for the client to login with a given provider name.
- GET `OID/p/PROVIDER_NAME`: This is the OpenID initiator: it will begin the authorization flow for OpenID with a given provider name.
+- GET `OID/redirect/PROVIDER_NAME`: This is the OpenID callback path. This will return HTML and JavaScript for the client to login with a given provider name.
+- GET `OID/start/PROVIDER_NAME`: This is the OpenID initiator: it will begin the authorization flow for OpenID with a given provider name.
 - POST `OID/Auth/PROVIDER_NAME`: This is the OpenID client-side API: the HTML and JavaScript client will call this endpoint to receive Jellyfin credentials for a given provider name. Post format is in JSON with the following keys:
  - `deviceId`: string. Device ID.
  - `deviceName`: string. Device name.
@@ -189,7 +223,7 @@ These all require authorization. Append an API key to the end of the request: `c
  - `oidClientId`: string. The OpenID client ID.
  - `oidSecret`: string. The OpenID secret.
  - `enabled`: boolean. Determines if the provider is enabled or not.
-  - `enableAuthorization`: boolean: Determines if the plugin sets permissions for the user. If false, the user will start with no permissions and an administrator will add permissions. The permissions of existing users will not be rewritten on subsequent logins.
+  - `enableAuthorization`: boolean: Determines if the plugin sets permissions for the user. If false, the user will start with no permissions and an administrator will add permissions. If disabled, then the permissions of users will not be modified and the Jellyfin defaults will be used instead.
  - `enableAllFolders`: boolean. Determines if the client logging in is allowed access to all folders.
  - `enabledFolders`: array of strings. If `enableAllFolders` is set to false, then this will be used to determine what folders the users who log in through this provider are allowed to use.
  - `roles`: array of strings. This validates the OpenID response against the claim set in `roleClaim`. If a user has any of these roles, then the user is authenticated. Leave blank to disable role checking. This currently only works for Keycloak (to my knowledge).
@@ -207,7 +241,11 @@ These all require authorization. Append an API key to the end of the request: `c
    - Leave empty to only request the default scopes.
  - `defaultProvider`: string. The set provider then gets assigned to the user after they have logged in. If it is not set, nothing is changed. With this, a user can login with SSO but is still able to log in via other providers later. See the `Unregister` endpoint.
  - `defaultUsernameClaim`: string. The provider will use the claim to create the users' usernames. If not set, it fallbacks to `preferred_username`.
-  - `requireHttps`: boolean. Determines whether the OpenID discovery endpoint requires HTTP. It is advised NOT to set this to false. If not set, it fallbacks to `true`.
+  - `avatarUrlFormat`: string. The URL format for the users avatars. OIDC claims can be used by using the `@{claim_type}` syntax. If not set, the avatars won't change.
+  - `disableHttps`: boolean. Determines whether the OpenID discovery endpoint requires HTTPS.
+  - `doNotValidateEndpoints`: boolean. Determines whether the OpenID discovery process will validate endpoints. This may be required for Google.
+  - `doNotValidateIssuerName`: boolean. Determines whether the OpenID discovery process will validate the OpenID issuer name.
+  - `schemeOverride`: string. Sets the scheme for URLs used. Can be useful if the plugin refuses to use HTTPS URLs.
 - GET `OID/Del/PROVIDER_NAME`: This removes a configuration for OpenID for a given provider name.
 - GET `OID/Get`: Lists the configurations currently available.
 - GET `OID/States`: Lists currently active OpenID flows in progress.
@@ -218,18 +256,24 @@ These all require authorization. Append an API key to the end of the request: `c

 ## Limitations

-There is no GUI to sign in. You have to make it yourself! The buttons should redirect to something like this: [https://myjellyfin.example.com/sso/SAML/p/clientid](https://myjellyfin.example.com/sso/SAML/p/clientid) replacing `clientid` with the provider client ID and `SAML` with the auth scheme (either `SAML` or `OID`).
+Logging in with an SSO account that has the same username as an existing Jellyfin account will override the permissions for the user. Use caution when overriding the administrator account!
+
+~~There is no GUI to sign in. You have to make it yourself! The buttons should redirect to something like this: [https://myjellyfin.example.com/sso/SAML/start/clientid](https://myjellyfin.example.com/sso/SAML/start/clientid) replacing `clientid` with the provider client ID and `SAML` with the auth scheme (either `SAML` or `OID`).~~

 ~~Furthermore, there is no functional admin page (yet). PRs for this are welcome. In the meantime, you have to interact with the API to add or remove configurations.~~ Added by [strazto](https://github.com/strazto) in PR [#18](https://github.com/9p4/jellyfin-plugin-sso/pull/18) and [#27](https://github.com/9p4/jellyfin-plugin-sso/pull/27).

 There is also no logout callback. Logging out of Jellyfin will log you out of Jellyfin only, instead of the SSO provider as well.

-~~This only supports Jellyfin on it's own domain (for now). This is because I'm using string concatenation for generating some URLs. A PR is welcome to patch this.~~ Fixed in [PR #1](https://github.com/9p4/jellyfin-plugin-sso/pull/1).
+~~This only supports Jellyfin on its own domain (for now). This is because I'm using string concatenation for generating some URLs. A PR is welcome to patch this.~~ Fixed in [PR #1](https://github.com/9p4/jellyfin-plugin-sso/pull/1).

 **This only works on the web UI**. ~~The user must open the Jellyfin web UI BEFORE using the SSO program to populate some values in the localStorage.~~ Fixed by implementing a comment by [Pfuenzle](https://github.com/Pfuenzle) in [Issue #5](https://github.com/9p4/jellyfin-plugin-sso/issues/5#issuecomment-1041864820).

 # Contributing

+## Dependencies
+
+This project uses Nix flakes to manage development dependencies. Run `nix develop` to use the same toolchain versions.
+
 ## Building

 This is built with .NET 6.0. Build with `dotnet publish .` for the debug release in the `SSO-Auth` directory. Copy over the `IdentityModel.OidcClient.dll`, the `IdentityModel.dll` and the `SSO-Auth.dll` files in the `/bin/Debug/net6.0/publish` directory to a new folder in your Jellyfin configuration: `config/plugins/sso`.
@@ -269,7 +313,7 @@ Much thanks to the [Jellyfin LDAP plugin](https://github.com/jellyfin/jellyfin-p

 I use the [AspNet SAML](https://github.com/jitbit/AspNetSaml/) library for the SAML side of things (patched to work with Base64 on non-Windows machines).

-I use the [IdentityModel OIDC Client](https://github.com/IdentityModel/IdentityModel.OidcClient/) library for the OpenID side of things.
+I use the [Duende IdentityModel OIDC Client](https://github.com/DuendeSoftware/foss) library for the OpenID side of things.

 Thanks to these projects, without which I would have been pulling my hair out implementing these protocols from scratch.

@@ -0,0 +1,3 @@
+Please email all security vulnerabilities and issues found to the email "contact at ersei dot net". If using LLMs/AI to find the issues, first verify the issue exists manually. Please do not publicly disclose security vulnerabilities until after a stable release for the fix has been released for 30 days.
+
+The latest released version is the only supported version.
@@ -1,10 +1,12 @@

 Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio Version 16
-VisualStudioVersion = 16.0.30114.105
+# Visual Studio Version 17
+VisualStudioVersion = 17.0.31903.59
 MinimumVisualStudioVersion = 10.0.40219.1
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "SSO-Auth", "SSO-Auth\SSO-Auth.csproj", "{C30A5CFB-B27E-4E83-9E96-1E0362B36748}"
 EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "SSO-Auth.Tests", "tests\SSO-Auth.Tests\SSO-Auth.Tests.csproj", "{7C4C3F90-33B5-4A8E-9C1A-5A6D2F9E8B41}"
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|Any CPU = Debug|Any CPU
@@ -18,5 +20,9 @@ Global
 		{C30A5CFB-B27E-4E83-9E96-1E0362B36748}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{C30A5CFB-B27E-4E83-9E96-1E0362B36748}.Release|Any CPU.ActiveCfg = Release|Any CPU
 		{C30A5CFB-B27E-4E83-9E96-1E0362B36748}.Release|Any CPU.Build.0 = Release|Any CPU
+		{7C4C3F90-33B5-4A8E-9C1A-5A6D2F9E8B41}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{7C4C3F90-33B5-4A8E-9C1A-5A6D2F9E8B41}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{7C4C3F90-33B5-4A8E-9C1A-5A6D2F9E8B41}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{7C4C3F90-33B5-4A8E-9C1A-5A6D2F9E8B41}.Release|Any CPU.Build.0 = Release|Any CPU
 	EndGlobalSection
 EndGlobal
@@ -9,7 +9,8 @@

 using System;
 using System.Threading.Tasks;
-using Jellyfin.Data.Enums;
+using Jellyfin.Data;
+using Jellyfin.Database.Implementations.Enums;
 using MediaBrowser.Controller.Net;
 using Microsoft.AspNetCore.Http;

@@ -1,24 +1,31 @@
 using System;
 using System.Collections.Generic;
+using System.IO;
 using System.Linq;
+using System.Net.Http;
 using System.Net.Mime;
+using System.Reflection;
 using System.Security.Cryptography;
 using System.Text.RegularExpressions;
 using System.Threading.Tasks;
-using IdentityModel.OidcClient;
-using Jellyfin.Data.Entities;
-using Jellyfin.Data.Enums;
+using Duende.IdentityModel.OidcClient;
+using Jellyfin.Data;
+using Jellyfin.Database.Implementations.Entities;
+using Jellyfin.Database.Implementations.Enums;
 using Jellyfin.Plugin.SSO_Auth.Config;
 using Jellyfin.Plugin.SSO_Auth.Helpers;
+using Jellyfin.Plugin.SSO_Auth.State;
+using MediaBrowser.Common.Api;
 using MediaBrowser.Controller.Authentication;
+using MediaBrowser.Controller.Configuration;
 using MediaBrowser.Controller.Library;
 using MediaBrowser.Controller.Net;
+using MediaBrowser.Controller.Providers;
 using MediaBrowser.Controller.Session;
 using MediaBrowser.Model.Cryptography;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
-using Microsoft.AspNetCore.Routing;
 using Microsoft.Extensions.Logging;
 using Newtonsoft.Json;
 using Newtonsoft.Json.Linq;
@@ -32,28 +39,64 @@ namespace Jellyfin.Plugin.SSO_Auth.Api;
 [Route("[controller]")]
 public class SSOController : ControllerBase
 {
+    /// <summary>
+    /// What the user is told when the state store cannot be reached. A store failure is never treated
+    /// as a valid state, so the login is rejected rather than allowed through.
+    /// </summary>
+    private const string StateStoreUnavailable = "Login state is unavailable. Try again.";
+
    private readonly IUserManager _userManager;
    private readonly ISessionManager _sessionManager;
    private readonly IAuthorizationContext _authContext;
    private readonly ILogger<SSOController> _logger;
+    private readonly ILoggerFactory _loggerFactory;
    private readonly ICryptoProvider _cryptoProvider;
-    private static readonly IDictionary<string, TimedAuthorizeState> StateManager = new Dictionary<string, TimedAuthorizeState>();
+    private readonly IProviderManager _providerManager;
+    private readonly IServerConfigurationManager _serverConfigurationManager;
+    private readonly IHttpClientFactory _httpClientFactory;
+    private readonly ISsoStateStore _stateStore;
+
+    /// <summary>
+    /// How long a prepared OpenID state stays usable. Long enough to cover an interactive provider
+    /// login including multi-factor prompts, short enough to bound replay of an unredeemed state.
+    /// </summary>
+    private static readonly TimeSpan StateExpiry = TimeSpan.FromSeconds(300);

    /// <summary>
    /// Initializes a new instance of the <see cref="SSOController"/> class.
    /// </summary>
    /// <param name="logger">Instance of the <see cref="ILogger{SSOController}"/> interface.</param>
+    /// <param name="loggerFactory">Instance of the <see cref="ILoggerFactory"/> interface.</param>
    /// <param name="sessionManager">Instance of the <see cref="ISessionManager"/> interface.</param>
    /// <param name="authContext">Instance of the <see cref="IAuthorizationContext"/> interface.</param>
    /// <param name="userManager">Instance of the <see cref="IUserManager"/> interface.</param>
    /// <param name="cryptoProvider">Instance of the <see cref="ICryptoProvider"/> interface.</param>
-    public SSOController(ILogger<SSOController> logger, ISessionManager sessionManager, IUserManager userManager, IAuthorizationContext authContext, ICryptoProvider cryptoProvider)
+    /// <param name="providerManager">Instance of the <see cref="IProviderManager"/> interface.</param>
+    /// <param name="httpClientFactory">Instance of the <see cref="IHttpClientFactory"/> interface.</param>
+    /// <param name="serverConfigurationManager">Instance of the <see cref="IServerConfigurationManager"/> interface.</param>
+    /// <param name="stateStore">Instance of the <see cref="ISsoStateStore"/> interface.</param>
+    public SSOController(
+        ILogger<SSOController> logger,
+        ILoggerFactory loggerFactory,
+        ISessionManager sessionManager,
+        IUserManager userManager,
+        IAuthorizationContext authContext,
+        ICryptoProvider cryptoProvider,
+        IProviderManager providerManager,
+        IHttpClientFactory httpClientFactory,
+        IServerConfigurationManager serverConfigurationManager,
+        ISsoStateStore stateStore)
    {
        _sessionManager = sessionManager;
        _userManager = userManager;
        _authContext = authContext;
        _cryptoProvider = cryptoProvider;
        _logger = logger;
+        _loggerFactory = loggerFactory;
+        _providerManager = providerManager;
+        _serverConfigurationManager = serverConfigurationManager;
+        _httpClientFactory = httpClientFactory;
+        _stateStore = stateStore;
        _logger.LogInformation("SSO Controller initialized");
    }

@@ -65,6 +108,7 @@ public class SSOController : ControllerBase
    /// <returns>A webpage that will complete the client-side flow.</returns>
    // Actually a GET: https://github.com/IdentityModel/IdentityModel.OidcClient/issues/325
    [HttpGet("OID/r/{provider}")]
+    [HttpGet("OID/redirect/{provider}")]
    public async Task<ActionResult> OidPost(
        [FromRoute] string provider,
        [FromQuery] string state) // Although this is a GET function, this function is called `Post` for consistency with SAML
@@ -81,44 +125,85 @@ public class SSOController : ControllerBase

        if (config.Enabled)
        {
+            if (string.IsNullOrEmpty(state))
+            {
+                return BadRequest("Missing state");
+            }
+
+            var lookup = await TryStateReadAsync(() => _stateStore.GetAsync(state), "read").ConfigureAwait(false);
+            if (!lookup.Succeeded)
+            {
+                return ReturnError(StatusCodes.Status503ServiceUnavailable, StateStoreUnavailable);
+            }
+
+            var timedState = lookup.Value;
+            if (timedState is null)
+            {
+                return BadRequest("Invalid or expired state");
+            }
+
+            var scopes = config.OidScopes == null ? new string[2] : config.OidScopes;
            var options = new OidcClientOptions
            {
                Authority = config.OidEndpoint?.Trim(),
                ClientId = config.OidClientId?.Trim(),
                ClientSecret = config.OidSecret?.Trim(),
-                RedirectUri = GetRequestBase() + "/sso/OID/r/" + provider,
-                Scope = string.Join(" ", config.OidScopes.Prepend("openid profile")),
+                RedirectUri = GetRequestBase(config.SchemeOverride, config.PortOverride) + $"/sso/OID/{(Request.Path.Value.Contains("/start/", StringComparison.InvariantCultureIgnoreCase) ? "redirect" : "r")}/" + provider,
+                Scope = string.Join(" ", scopes.Prepend("openid profile")),
+                DisablePushedAuthorization = config.DisablePushedAuthorization,
+                LoggerFactory = _loggerFactory,
+                LoadProfile = !config.DoNotLoadProfile,
+                HttpClientFactory = o =>
+                {
+                    var client = _httpClientFactory.CreateClient();
+                    System.Reflection.Assembly assembly = System.Reflection.Assembly.GetExecutingAssembly();
+                    System.Diagnostics.FileVersionInfo fvi = System.Diagnostics.FileVersionInfo.GetVersionInfo(assembly.Location);
+                    string version = fvi.FileVersion;
+                    client.DefaultRequestHeaders.UserAgent.ParseAdd($"Jellyfin-Plugin-SSO-Auth +{version} (https://github.com/9p4/jellyfin-plugin-sso)");
+                    return client;
+                }
            };
-            options.Policy.Discovery.ValidateEndpoints = false; // For Google and other providers with different endpoints
-            options.Policy.Discovery.RequireHttps = config.RequireHttps;
+            var oidEndpointUri = new Uri(config.OidEndpoint?.Trim());
+            options.Policy.Discovery.AdditionalEndpointBaseAddresses.Add(oidEndpointUri.GetLeftPart(UriPartial.Authority));
+            options.Policy.Discovery.ValidateEndpoints = !config.DoNotValidateEndpoints; // For Google and other providers with different endpoints
+            options.Policy.Discovery.RequireHttps = !config.DisableHttps;
+            options.Policy.Discovery.ValidateIssuerName = !config.DoNotValidateIssuerName;
            var oidcClient = new OidcClient(options);
-            var currentState = StateManager[state].State;
+            var currentState = timedState.State;
            var result = await oidcClient.ProcessResponseAsync(Request.QueryString.Value, currentState).ConfigureAwait(false);
+
            if (result.IsError)
            {
-                return ReturnError(StatusCodes.Status400BadRequest, result.Error + " Try logging in again.");
+                return ReturnError(StatusCodes.Status400BadRequest, $"Error logging in: {result.Error} - {result.ErrorDescription}");
            }

-            if (!config.EnableFolderRoles)
+            if (!config.EnableFolderRoles && config.EnabledFolders != null)
            {
-                StateManager[state].Folders = new List<string>(config.EnabledFolders);
+                timedState.Folders = new List<string>(config.EnabledFolders);
            }
            else
            {
-                StateManager[state].Folders = new List<string>();
+                timedState.Folders = new List<string>();
            }

-            StateManager[state].EnableLiveTv = config.EnableLiveTv;
-            StateManager[state].EnableLiveTvManagement = config.EnableLiveTvManagement;
+            timedState.EnableLiveTv = config.EnableLiveTv;
+            timedState.EnableLiveTvManagement = config.EnableLiveTvManagement;
+
+            if (config.AvatarUrlFormat is not null)
+            {
+                timedState.AvatarURL = result.User.Claims.Aggregate(
+                    config.AvatarUrlFormat,
+                    (s, claim) => s.Contains($"@{{{claim.Type}}}") ? s.Replace($"@{{{claim.Type}}}", claim.Value) : s);
+            }

            foreach (var claim in result.User.Claims)
            {
                if (claim.Type == (config.DefaultUsernameClaim?.Trim() ?? "preferred_username"))
                {
-                    StateManager[state].Username = claim.Value;
+                    timedState.Username = claim.Value;
                    if (config.Roles == null || config.Roles.Length == 0)
                    {
-                        StateManager[state].Valid = true;
+                        timedState.Valid = true;
                    }
                }

@@ -144,14 +229,40 @@ public class SSOController : ControllerBase
                        {
                            // We recursively traverse through the JSON data for the roles and parse it
                            var json = JsonConvert.DeserializeObject<IDictionary<string, object>>(claim.Value);
-                            for (int i = 1; i < segments.Length - 1; i++)
+                            if (json is null)
                            {
-                                var segment = segments[i];
-                                json = (json[segment] as JObject).ToObject<IDictionary<string, object>>();
+                                roles = new List<string>();
                            }
+                            else
+                            {
+                                bool missingSegment = false;
+                                for (int i = 1; i < segments.Length - 1; i++)
+                                {
+                                    var segment = segments[i];
+                                    if (!json.TryGetValue(segment, out var nextToken) || nextToken is not JObject nextObject)
+                                    {
+                                        missingSegment = true;
+                                        break;
+                                    }

-                            // The final step is to take the JSON and turn it from a dictionary into a string
-                            roles = (json[segments[^1]] as JArray).ToObject<List<string>>();
+                                    json = nextObject.ToObject<IDictionary<string, object>>();
+                                    if (json is null)
+                                    {
+                                        missingSegment = true;
+                                        break;
+                                    }
+                                }
+
+                                if (missingSegment || !json.TryGetValue(segments[^1], out var rolesToken) || rolesToken is not JArray rolesArray)
+                                {
+                                    roles = new List<string>();
+                                }
+                                else
+                                {
+                                    // The final step is to take the JSON and turn it from a dictionary into a string
+                                    roles = rolesArray.ToObject<List<string>>();
+                                }
+                            }
                        }

                        foreach (string role in roles)
@@ -163,7 +274,7 @@ public class SSOController : ControllerBase
                                {
                                    if (role.Equals(validRoles))
                                    {
-                                        StateManager[state].Valid = true;
+                                        timedState.Valid = true;
                                    }
                                }
                            }
@@ -175,7 +286,7 @@ public class SSOController : ControllerBase
                                {
                                    if (role.Equals(validAdminRoles))
                                    {
-                                        StateManager[state].Admin = true;
+                                        timedState.Admin = true;
                                    }
                                }
                            }
@@ -187,7 +298,7 @@ public class SSOController : ControllerBase
                                {
                                    if (role.Equals(folderRoleMap.Role?.Trim()))
                                    {
-                                        StateManager[state].Folders.AddRange(folderRoleMap.Folders);
+                                        timedState.Folders.AddRange(folderRoleMap.Folders);
                                    }
                                }
                            }
@@ -201,7 +312,7 @@ public class SSOController : ControllerBase
                                    {
                                        if (role.Equals(validLiveTvRoles))
                                        {
-                                            StateManager[state].EnableLiveTv = true;
+                                            timedState.EnableLiveTv = true;
                                        }
                                    }
                                }
@@ -213,7 +324,7 @@ public class SSOController : ControllerBase
                                    {
                                        if (role.Equals(validLiveTvManagementRoles))
                                        {
-                                            StateManager[state].EnableLiveTvManagement = true;
+                                            timedState.EnableLiveTvManagement = true;
                                        }
                                    }
                                }
@@ -224,38 +335,31 @@ public class SSOController : ControllerBase
            }

            // If the provider doesn't support the preferred username claim, then use the sub claim
-            if (!StateManager[state].Valid)
+            if (!timedState.Valid)
            {
                foreach (var claim in result.User.Claims)
                {
                    if (claim.Type == "sub")
                    {
-                        StateManager[state].Username = claim.Value;
+                        timedState.Username = claim.Value;
                        if (config.Roles.Length == 0)
                        {
-                            StateManager[state].Valid = true;
+                            timedState.Valid = true;
                        }
                    }
                }
            }

-            bool isLinking = StateManager[state].IsLinking;
-
-            if (StateManager[state].Valid)
-            {
-                _logger.LogInformation($"Is request linking: {isLinking}");
-                return Content(WebResponse.Generator(data: state, provider: provider, baseUrl: GetRequestBase(), mode: "OID", isLinking: isLinking), MediaTypeNames.Text.Html);
-            }
-            else
+            if (!timedState.Valid)
            {
                _logger.LogWarning(
                    "OpenID user {Username} has one or more incorrect role claims: {@Claims}. Expected any one of: {@ExpectedClaims}",
-                    StateManager[state].Username,
+                    timedState.Username,
                    result.User.Claims.Select(o => new { o.Type, o.Value }),
                    config.Roles);
-
-                return ReturnError(StatusCodes.Status401Unauthorized, "Error. Check permissions.");
            }
+
+            return await CompleteOidState(provider, state, timedState, GetRequestBase(config.SchemeOverride, config.PortOverride)).ConfigureAwait(false);
        }

        // If the config doesn't have an active provider matching the requeset, show an error
@@ -269,9 +373,9 @@ public class SSOController : ControllerBase
    /// <param name="isLinking">Whether or not this request is to link accounts (Rather than authenticate).</param>
    /// <returns>An asynchronous result for the authentication.</returns>
    [HttpGet("OID/p/{provider}")]
+    [HttpGet("OID/start/{provider}")]
    public async Task<ActionResult> OidChallenge(string provider, [FromQuery] bool isLinking = false)
    {
-        Invalidate();
        OidConfig config;
        try
        {
@@ -284,21 +388,56 @@ public class SSOController : ControllerBase

        if (config.Enabled)
        {
+            bool newPath = config.NewPath;
+            if (!isLinking)
+            {
+                newPath = Request.Path.Value.Contains("/start/", StringComparison.InvariantCultureIgnoreCase);
+                config.NewPath = newPath;
+            }
+
+            string redirectUri = GetRequestBase(config.SchemeOverride, config.PortOverride) + $"/sso/OID/{(newPath ? "redirect" : "r")}/" + provider;
+
            var options = new OidcClientOptions
            {
                Authority = config.OidEndpoint?.Trim(),
                ClientId = config.OidClientId?.Trim(),
                ClientSecret = config.OidSecret?.Trim(),
-                RedirectUri = GetRequestBase() + "/sso/OID/r/" + provider,
+                RedirectUri = redirectUri,
                Scope = string.Join(" ", config.OidScopes.Prepend("openid profile")),
+                DisablePushedAuthorization = config.DisablePushedAuthorization,
+                LoggerFactory = _loggerFactory,
+                LoadProfile = !config.DoNotLoadProfile,
+                HttpClientFactory = o =>
+                {
+                    var client = _httpClientFactory.CreateClient();
+                    System.Reflection.Assembly assembly = System.Reflection.Assembly.GetExecutingAssembly();
+                    System.Diagnostics.FileVersionInfo fvi = System.Diagnostics.FileVersionInfo.GetVersionInfo(assembly.Location);
+                    string version = fvi.FileVersion;
+
+                    client.DefaultRequestHeaders.UserAgent.ParseAdd($"Jellyfin-Plugin-SSO-Auth +{version} (https://github.com/9p4/jellyfin-plugin-sso)");
+                    return client;
+                }
            };
-            options.Policy.Discovery.ValidateEndpoints = false; // For Google and other providers with different endpoints
+            var oidEndpointUri = new Uri(config.OidEndpoint?.Trim());
+            options.Policy.Discovery.AdditionalEndpointBaseAddresses.Add(oidEndpointUri.GetLeftPart(UriPartial.Authority));
+            options.Policy.Discovery.ValidateEndpoints = !config.DoNotValidateEndpoints; // For Google and other providers with different endpoints
+            options.Policy.Discovery.RequireHttps = !config.DisableHttps;
+            options.Policy.Discovery.ValidateIssuerName = !config.DoNotValidateIssuerName;
            var oidcClient = new OidcClient(options);
            var state = await oidcClient.PrepareLoginAsync().ConfigureAwait(false);
-            StateManager.Add(state.State, new TimedAuthorizeState(state, DateTime.Now));
+
+            if (state.IsError)
+            {
+                return ReturnError(StatusCodes.Status400BadRequest, $"Error preparing login: {state.Error} - {state.ErrorDescription}");
+            }

            // Track whether this is a linking request or not.
-            StateManager[state.State].IsLinking = isLinking;
+            var timedState = new TimedAuthorizeState(state, DateTime.Now) { IsLinking = isLinking };
+            if (!await TryStateWriteAsync(() => _stateStore.CreateAsync(timedState, StateExpiry), "create").ConfigureAwait(false))
+            {
+                return ReturnError(StatusCodes.Status503ServiceUnavailable, StateStoreUnavailable);
+            }
+
            return Redirect(state.StartUrl);
        }

@@ -310,7 +449,7 @@ public class SSOController : ControllerBase
    /// </summary>
    /// <param name="provider">The name of the provider to add.</param>
    /// <param name="config">The OID configuration (deserialized from a JSON post).</param>
-    [Authorize(Policy = "RequiresElevation")]
+    [Authorize(Policy = Policies.RequiresElevation)]
    [HttpPost("OID/Add/{provider}")]
    public void OidAdd(string provider, [FromBody] OidConfig config)
    {
@@ -323,7 +462,7 @@ public class SSOController : ControllerBase
    /// Deletes an OpenID provider.
    /// </summary>
    /// <param name="provider">Name of provider to delete.</param>
-    [Authorize(Policy = "RequiresElevation")]
+    [Authorize(Policy = Policies.RequiresElevation)]
    [HttpGet("OID/Del/{provider}")]
    public void OidDel(string provider)
    {
@@ -336,7 +475,7 @@ public class SSOController : ControllerBase
    /// Lists the OpenID providers configured. Requires administrator privileges.
    /// </summary>
    /// <returns>The list of OpenID configurations.</returns>
-    [Authorize(Policy = "RequiresElevation")]
+    [Authorize(Policy = Policies.RequiresElevation)]
    [HttpGet("OID/Get")]
    public ActionResult OidProviders()
    {
@@ -366,12 +505,18 @@ public class SSOController : ControllerBase
    /// <summary>
    /// This is a debug endpoint to list all running OpenID flows. Requires administrator privileges.
    /// </summary>
-    /// <returns>The list of OpenID flows in progress.</returns>
-    [Authorize(Policy = "RequiresElevation")]
+    /// <returns>The list of OpenID flows in progress, without their PKCE code verifiers.</returns>
+    [Authorize(Policy = Policies.RequiresElevation)]
    [HttpGet("OID/States")]
-    public ActionResult OidStates()
+    public async Task<ActionResult> OidStates()
    {
-        return Ok(StateManager);
+        var listed = await TryStateReadAsync(() => _stateStore.ListAsync(), "list").ConfigureAwait(false);
+        if (!listed.Succeeded)
+        {
+            return ReturnError(StatusCodes.Status503ServiceUnavailable, StateStoreUnavailable);
+        }
+
+        return Ok(listed.Value.Select(SsoStateInfo.FromState).ToList());
    }

    /// <summary>
@@ -397,16 +542,31 @@ public class SSOController : ControllerBase

        if (config.Enabled)
        {
-            foreach (var kvp in StateManager)
+            // The state is redeemed here, so a replay of the same response finds nothing.
+            var redeemed = await TryStateReadAsync(() => _stateStore.ConsumeAsync(response.Data), "redeem").ConfigureAwait(false);
+            if (!redeemed.Succeeded)
            {
-                if (kvp.Value.State.State.Equals(response.Data) && kvp.Value.Valid)
-                {
-                    Guid userId = await CreateCanonicalLinkAndUserIfNotExist("oid", provider, kvp.Value.Username);
+                return Problem(StateStoreUnavailable, statusCode: StatusCodes.Status503ServiceUnavailable);
+            }

-                    var authenticationResult = await Authenticate(userId, kvp.Value.Admin, config.EnableAuthorization, config.EnableAllFolders, kvp.Value.Folders.ToArray(), kvp.Value.EnableLiveTv, kvp.Value.EnableLiveTvManagement, response, config.DefaultProvider?.Trim())
-                        .ConfigureAwait(false);
-                    return Ok(authenticationResult);
-                }
+            var timedState = redeemed.Value;
+            if (timedState is not null && timedState.Valid)
+            {
+                Guid userId = await CreateCanonicalLinkAndUserIfNotExist("oid", provider, timedState.Username);
+
+                var authenticationResult = await Authenticate(
+                    userId,
+                    timedState.Admin,
+                    config.EnableAuthorization,
+                    config.EnableAllFolders,
+                    timedState.Folders.ToArray(),
+                    timedState.EnableLiveTv,
+                    timedState.EnableLiveTvManagement,
+                    response,
+                    config.DefaultProvider?.Trim(),
+                    timedState.AvatarURL)
+                    .ConfigureAwait(false);
+                return Ok(authenticationResult);
            }
        }

@@ -423,6 +583,7 @@ public class SSOController : ControllerBase
    /// </param>
    /// <returns>A webpage that will complete the client-side flow.</returns>
    [HttpPost("SAML/p/{provider}")]
+    [HttpPost("SAML/post/{provider}")]
    public ActionResult SamlPost(string provider, [FromQuery] string relayState = null)
    {
        SamlConfig config;
@@ -444,6 +605,11 @@ public class SSOController : ControllerBase
        {
            var samlResponse = new Response(config.SamlCertificate, Request.Form["SAMLResponse"]);

+            if (!samlResponse.IsValid())
+            {
+                return Problem("Invalid SAML signature");
+            }
+
            bool valid = false;

            // If no roles are configured, don't use RBAC
@@ -470,7 +636,7 @@ public class SSOController : ControllerBase
                        WebResponse.Generator(
                            data: Convert.ToBase64String(System.Text.Encoding.UTF8.GetBytes(samlResponse.Xml)),
                            provider: provider,
-                            baseUrl: GetRequestBase(),
+                            baseUrl: GetRequestBase(config.SchemeOverride, config.PortOverride),
                            mode: "SAML",
                            isLinking: isLinking),
                        MediaTypeNames.Text.Html);
@@ -494,6 +660,7 @@ public class SSOController : ControllerBase
    /// <param name="isLinking">Whether this flow intends to link an account, or initiate auth.</param>
    /// <returns>A redirect to the SAML provider's auth page.</returns>
    [HttpGet("SAML/p/{provider}")]
+    [HttpGet("SAML/start/{provider}")]
    public RedirectResult SamlChallenge(string provider, [FromQuery] bool isLinking = false)
    {
        SamlConfig config;
@@ -508,6 +675,14 @@ public class SSOController : ControllerBase

        if (config.Enabled)
        {
+            bool newPath = config.NewPath;
+            if (!isLinking)
+            {
+                newPath = Request.Path.Value.Contains("/start/", StringComparison.InvariantCultureIgnoreCase);
+                config.NewPath = newPath;
+            }
+
+            string redirectUri = GetRequestBase(config.SchemeOverride, config.PortOverride) + $"/sso/SAML/{(newPath ? "post" : "p")}/" + provider;
            string relayState = null;
            if (isLinking)
            {
@@ -516,7 +691,7 @@ public class SSOController : ControllerBase

            var request = new AuthRequest(
                config.SamlClientId.Trim(),
-                GetRequestBase() + "/sso/SAML/p/" + provider);
+                redirectUri);

            return Redirect(request.GetRedirectUrl(config.SamlEndpoint.Trim(), relayState));
        }
@@ -530,7 +705,7 @@ public class SSOController : ControllerBase
    /// <param name="provider">The provider name to add.</param>
    /// <param name="newConfig">The SAML configuration object (deserialized) from JSON.</param>
    /// <returns>The success result.</returns>
-    [Authorize(Policy = "RequiresElevation")]
+    [Authorize(Policy = Policies.RequiresElevation)]
    [HttpPost("SAML/Add/{provider}")]
    public OkResult SamlAdd(string provider, [FromBody] SamlConfig newConfig)
    {
@@ -545,7 +720,7 @@ public class SSOController : ControllerBase
    /// </summary>
    /// <param name="provider">The ID of the provider to delete.</param>
    /// <returns>The success result.</returns>
-    [Authorize(Policy = "RequiresElevation")]
+    [Authorize(Policy = Policies.RequiresElevation)]
    [HttpGet("SAML/Del/{provider}")]
    public OkResult SamlDel(string provider)
    {
@@ -559,7 +734,7 @@ public class SSOController : ControllerBase
    /// Returns a list of all SAML providers configured. Requires administrator privileges.
    /// </summary>
    /// <returns>A list of all of the Saml providers available.</returns>
-    [Authorize(Policy = "RequiresElevation")]
+    [Authorize(Policy = Policies.RequiresElevation)]
    [HttpGet("SAML/Get")]
    public ActionResult SamlProviders()
    {
@@ -593,8 +768,14 @@ public class SSOController : ControllerBase
            bool liveTv = config.EnableLiveTv;
            bool liveTvManagement = config.EnableLiveTvManagement;
            var samlResponse = new Response(config.SamlCertificate, response.Data);
+
+            if (!samlResponse.IsValid())
+            {
+                return Problem("Invalid SAML signature");
+            }
+
            List<string> folders;
-            if (!config.EnableFolderRoles)
+            if (!config.EnableFolderRoles && config.EnabledFolders != null)
            {
                folders = new List<string>(config.EnabledFolders);
            }
@@ -618,11 +799,14 @@ public class SSOController : ControllerBase

                if (config.EnableFolderRoles)
                {
-                    foreach (FolderRoleMap folderRoleMap in config.FolderRoleMapping)
+                    if (config.FolderRoleMapping != null)
                    {
-                        if (folderRoleMap.Role.Equals(role))
+                        foreach (FolderRoleMap folderRoleMap in config.FolderRoleMapping)
                        {
-                            folders.AddRange(folderRoleMap.Folders);
+                            if (folderRoleMap.Role.Equals(role))
+                            {
+                                folders.AddRange(folderRoleMap.Folders);
+                            }
                        }
                    }
                }
@@ -655,7 +839,17 @@ public class SSOController : ControllerBase

            Guid userId = await CreateCanonicalLinkAndUserIfNotExist("saml", provider, samlResponse.GetNameID());

-            var authenticationResult = await Authenticate(userId, isAdmin, config.EnableAuthorization, config.EnableAllFolders, folders.ToArray(), liveTv, liveTvManagement, response, config.DefaultProvider.Trim())
+            var authenticationResult = await Authenticate(
+                userId,
+                isAdmin,
+                config.EnableAuthorization,
+                config.EnableAllFolders,
+                folders.ToArray(),
+                liveTv,
+                liveTvManagement,
+                response,
+                config.DefaultProvider?.Trim(),
+                null)
                .ConfigureAwait(false);
            return Ok(authenticationResult);
        }
@@ -669,7 +863,7 @@ public class SSOController : ControllerBase
    /// <param name="username">The username to switch to the new provider.</param>
    /// <param name="provider">The new provider to switch to.</param>
    /// <returns>Whether this API endpoint succeeded.</returns>
-    [Authorize(Policy = "RequiresElevation")]
+    [Authorize(Policy = Policies.RequiresElevation)]
    [HttpPost("Unregister/{username}")]
    public ActionResult Unregister(string username, [FromBody] string provider)
    {
@@ -706,7 +900,28 @@ public class SSOController : ControllerBase
    private async Task<Guid> CreateCanonicalLinkAndUserIfNotExist(string mode, string provider, string canonicalName)
    {
        User user = null;
-        user = _userManager.GetUserByName(canonicalName);
+
+        // First try to get the user by its id in case it was already registered before
+        Guid userId = Guid.Empty;
+        try
+        {
+            userId = GetCanonicalLink(mode, provider, canonicalName);
+        }
+        catch (KeyNotFoundException)
+        {
+            userId = Guid.Empty;
+        }
+
+        // No userId found? Let's try and find the user by name instead
+        if (userId == Guid.Empty)
+        {
+            user = _userManager.GetUserByName(canonicalName);
+        }
+        else
+        {
+            user = _userManager.GetUserById(userId);
+        }
+
        if (user == null)
        {
            _logger.LogInformation($"SSO user {canonicalName} doesn't exist, creating...");
@@ -721,7 +936,7 @@ public class SSOController : ControllerBase
            UpdateCanonicalLinkConfig(links, mode, provider);
        }

-        Guid userId = Guid.Empty;
+        userId = Guid.Empty;
        try
        {
            userId = GetCanonicalLink(mode, provider, canonicalName);
@@ -761,7 +976,7 @@ public class SSOController : ControllerBase
    /// <param name="jellyfinUserId">The user ID within jellyfin to link to the provider.</param>
    /// <param name="authResponse">The client information to authenticate the user with.</param>
    /// <returns>Whether this API endpoint succeeded.</returns>
-    [Authorize(Policy = "DefaultAuthorization")]
+    [Authorize]
    [HttpPost("{mode}/Link/{provider}/{jellyfinUserId}")]
    [Consumes(MediaTypeNames.Application.Json)]
    [Produces(MediaTypeNames.Application.Json)]
@@ -777,7 +992,7 @@ public class SSOController : ControllerBase
            case "saml":
                return SamlLink(provider, jellyfinUserId, authResponse);
            case "oid":
-                return OidLink(provider, jellyfinUserId, authResponse);
+                return await OidLink(provider, jellyfinUserId, authResponse).ConfigureAwait(false);
            default:
                throw new ArgumentException($"{mode} is not a valid choice between 'saml' and 'oid'");
        }
@@ -791,7 +1006,7 @@ public class SSOController : ControllerBase
    /// <param name="jellyfinUserId">The user ID within jellyfin to unlink from the provider.</param>
    /// <param name="canonicalName">The user ID within jellyfin to unlink.</param>
    /// <returns>Whether this API endpoint succeeded.</returns>
-    [Authorize(Policy = "DefaultAuthorization")]
+    [Authorize]
    [HttpDelete("{mode}/Link/{provider}/{jellyfinUserId}/{canonicalName}")]
    [Consumes(MediaTypeNames.Application.Json)]
    [Produces(MediaTypeNames.Application.Json)]
@@ -821,7 +1036,7 @@ public class SSOController : ControllerBase
    /// </summary>
    /// <param name="jellyfinUserId">The user ID within jellyfin for which to return the links.</param>
    /// <returns>A dictionary of provider : link mappings.</returns>
-    [Authorize(Policy = "DefaultAuthorization")]
+    [Authorize]
    [HttpGet("saml/links/{jellyfinUserId}")]
    [Produces(MediaTypeNames.Application.Json)]
    public async Task<ActionResult<SerializableDictionary<string, IEnumerable<string>>>> GetSamlLinksByUser(Guid jellyfinUserId)
@@ -849,7 +1064,7 @@ public class SSOController : ControllerBase
    /// </summary>
    /// <param name="jellyfinUserId">The user ID within jellyfin for which to return the links.</param>
    /// <returns>A dictionary of provider : link mappings.</returns>
-    [Authorize(Policy = "DefaultAuthorization")]
+    [Authorize]
    [HttpGet("oid/links/{jellyfinUserId}")]
    [Produces(MediaTypeNames.Application.Json)]
    public async Task<ActionResult<SerializableDictionary<string, IEnumerable<string>>>> GetOidLinksByUser(Guid jellyfinUserId)
@@ -897,7 +1112,11 @@ public class SSOController : ControllerBase
        }

        var samlResponse = new Response(config.SamlCertificate, response.Data);
-        // TODO: Does saml response require further validation?
+
+        if (!samlResponse.IsValid())
+        {
+            return Problem("Invalid SAML signature");
+        }

        string providerUserId = samlResponse.GetNameID();

@@ -916,7 +1135,7 @@ public class SSOController : ControllerBase
    /// <returns>JSON for the client to populate information with.</returns>
    [Consumes(MediaTypeNames.Application.Json)]
    [Produces(MediaTypeNames.Application.Json)]
-    private ActionResult OidLink(string provider, Guid jellyfinUserId, AuthResponse response)
+    private async Task<ActionResult> OidLink(string provider, Guid jellyfinUserId, AuthResponse response)
    {
        OidConfig config;
        try
@@ -928,13 +1147,16 @@ public class SSOController : ControllerBase
            return BadRequest("No matching provider found");
        }

-        foreach (var kvp in StateManager)
+        var lookup = await TryStateReadAsync(() => _stateStore.GetAsync(response.Data), "read").ConfigureAwait(false);
+        if (!lookup.Succeeded)
        {
-            if (kvp.Value.State.State.Equals(response.Data) && kvp.Value.Valid)
-            {
-                string providerUserId = kvp.Value.Username;
-                return CreateCanonicalLink("oid", provider, jellyfinUserId, providerUserId);
-            }
+            return Problem(StateStoreUnavailable, statusCode: StatusCodes.Status503ServiceUnavailable);
+        }
+
+        var timedState = lookup.Value;
+        if (timedState is not null && timedState.Valid)
+        {
+            return CreateCanonicalLink("oid", provider, jellyfinUserId, timedState.Username);
        }

        return Problem("Something went wrong!");
@@ -989,7 +1211,8 @@ public class SSOController : ControllerBase
    /// <param name="enableLiveTvAdmin">Determines whether live TV can be managed by this user.</param>
    /// <param name="authResponse">The client information to authenticate the user with.</param>
    /// <param name="defaultProvider">The default provider of the user to be set after logging in.</param>
-    private async Task<AuthenticationResult> Authenticate(Guid userId, bool isAdmin, bool enableAuthorization, bool enableAllFolders, string[] enabledFolders, bool enableLiveTv, bool enableLiveTvAdmin, AuthResponse authResponse, string defaultProvider)
+    /// <param name="avatarUrl">The new avatar url for the user.</param>
+    private async Task<AuthenticationResult> Authenticate(Guid userId, bool isAdmin, bool enableAuthorization, bool enableAllFolders, string[] enabledFolders, bool enableLiveTv, bool enableLiveTvAdmin, AuthResponse authResponse, string defaultProvider, string avatarUrl)
    {
        User user = _userManager.GetUserById(userId);
        if (enableAuthorization)
@@ -1002,6 +1225,56 @@ public class SSOController : ControllerBase
            }
        }

+        if (avatarUrl is not null)
+        {
+            try
+            {
+                using var client = _httpClientFactory.CreateClient();
+
+                System.Reflection.Assembly assembly = System.Reflection.Assembly.GetExecutingAssembly();
+                System.Diagnostics.FileVersionInfo fvi = System.Diagnostics.FileVersionInfo.GetVersionInfo(assembly.Location);
+                string version = fvi.FileVersion;
+                client.DefaultRequestHeaders.UserAgent.ParseAdd($"Jellyfin-Plugin-SSO-Auth +{version} (https://github.com/9p4/jellyfin-plugin-sso)");
+
+                var avatarResponse = await client.GetAsync(avatarUrl);
+
+                if (!avatarResponse.Content.Headers.TryGetValues("content-type", out var contentTypeList))
+                {
+                    throw new Exception("Cannot get Content-Type of image : " + avatarUrl);
+                }
+
+                var contentType = contentTypeList.First();
+                if (!contentType.StartsWith("image"))
+                {
+                    throw new Exception("Content type of avatar URL is not an image, got :  " + contentType);
+                }
+
+                var extension = contentType.Split("/").Last();
+                var stream = await avatarResponse.Content.ReadAsStreamAsync();
+
+                if (user != null)
+                {
+                    var userDataPath =
+                        Path.Combine(
+                            _serverConfigurationManager.ApplicationPaths.UserConfigurationDirectoryPath,
+                            user.Username);
+                    if (user.ProfileImage is not null)
+                    {
+                        await _userManager.ClearProfileImageAsync(user).ConfigureAwait(false);
+                    }
+
+                    user.ProfileImage = new ImageInfo(Path.Combine(userDataPath, "profile" + extension));
+
+                    await _providerManager.SaveImage(stream, contentType, user.ProfileImage.Path)
+                        .ConfigureAwait(false);
+                }
+            }
+            catch (Exception e)
+            {
+                _logger.LogError(e.Message);
+            }
+        }
+
        user.SetPermission(PermissionKind.EnableLiveTvAccess, enableLiveTv);
        user.SetPermission(PermissionKind.EnableLiveTvManagement, enableLiveTvAdmin);

@@ -1025,35 +1298,93 @@ public class SSOController : ControllerBase
        return await _sessionManager.AuthenticateDirect(authRequest).ConfigureAwait(false);
    }

-    private void Invalidate()
+    private string GetRequestBase(string schemeOverride = null, int? portOverride = null)
    {
-        foreach (var kvp in StateManager)
-        {
-            var now = DateTime.Now;
-            if (now.Subtract(kvp.Value.Created).TotalMinutes > 1)
-            {
-                StateManager.Remove(kvp.Key);
-            }
-        }
-    }
+        int requestPort;
+
+        if (portOverride != null)
+        {
+            requestPort = portOverride.Value;
+        }
+        else
+        {
+            requestPort = Request.Host.Port ?? -1;
+        }

-    private string GetRequestBase()
-    {
-        int requestPort = Request.Host.Port ?? -1;
        if ((requestPort == 80 && string.Equals(Request.Scheme, "http", StringComparison.OrdinalIgnoreCase)) || (requestPort == 443 && string.Equals(Request.Scheme, "https", StringComparison.OrdinalIgnoreCase)))
        {
            requestPort = -1;
        }

+        if (schemeOverride != "http" && schemeOverride != "https")
+        {
+            schemeOverride = null;
+        }
+
        return new UriBuilder
        {
-            Scheme = Request.Scheme,
+            Scheme = schemeOverride ?? Request.Scheme,
            Host = Request.Host.Host,
            Port = requestPort,
            Path = Request.PathBase
        }.ToString().TrimEnd('/');
    }

+    /// <summary>
+    /// Finishes a redirect leg once the provider response has been evaluated. A rejected login discards
+    /// its state instead of writing it back, so a failed role check cannot extend the state's lifetime.
+    /// </summary>
+    /// <param name="provider">The name of the provider.</param>
+    /// <param name="state">The OpenID state value.</param>
+    /// <param name="timedState">The evaluated state.</param>
+    /// <param name="baseUrl">The base URL of the Jellyfin installation.</param>
+    /// <returns>The response to serve to the client.</returns>
+    internal async Task<ActionResult> CompleteOidState(string provider, string state, TimedAuthorizeState timedState, string baseUrl)
+    {
+        ArgumentNullException.ThrowIfNull(timedState);
+
+        if (!timedState.Valid)
+        {
+            await TryStateWriteAsync(() => _stateStore.ConsumeAsync(state), "discard").ConfigureAwait(false);
+            return ReturnError(StatusCodes.Status401Unauthorized, "Error. Check permissions.");
+        }
+
+        if (!await TryStateWriteAsync(() => _stateStore.UpdateAsync(timedState, StateExpiry), "update").ConfigureAwait(false))
+        {
+            return ReturnError(StatusCodes.Status503ServiceUnavailable, StateStoreUnavailable);
+        }
+
+        _logger.LogInformation("Is request linking: {IsLinking}", timedState.IsLinking);
+        return Content(WebResponse.Generator(data: state, provider: provider, baseUrl: baseUrl, mode: "OID", isLinking: timedState.IsLinking), MediaTypeNames.Text.Html);
+    }
+
+    private async Task<(bool Succeeded, T Value)> TryStateReadAsync<T>(Func<Task<T>> operation, string action)
+    {
+        try
+        {
+            return (true, await operation().ConfigureAwait(false));
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "SSO state store {Action} failed; rejecting the request", action);
+            return (false, default);
+        }
+    }
+
+    private async Task<bool> TryStateWriteAsync(Func<Task> operation, string action)
+    {
+        try
+        {
+            await operation().ConfigureAwait(false);
+            return true;
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "SSO state store {Action} failed; rejecting the request", action);
+            return false;
+        }
+    }
+
    private ContentResult ReturnError(int code, string message)
    {
        var errorResult = new ContentResult();
@@ -1114,6 +1445,7 @@ public class TimedAuthorizeState
        IsLinking = false;
        EnableLiveTv = false;
        EnableLiveTvManagement = false;
+        AvatarURL = null;
    }

    /// <summary>
@@ -1161,4 +1493,9 @@ public class TimedAuthorizeState
    /// Gets or sets a value indicating whether the user is allowed to manage live TV.
    /// </summary>
    public bool EnableLiveTvManagement { get; set; }
+
+    /// <summary>
+    /// Gets or sets the user avatar url.
+    /// </summary>
+    public string AvatarURL { get; set; }
 }
@@ -126,6 +126,21 @@ public class SamlConfig
    /// </summary>
    public string DefaultProvider { get; set; }

+    /// <summary>
+    /// Gets or sets the redirect scheme override.
+    /// </summary>
+    public string SchemeOverride { get; set; }
+
+    /// <summary>
+    /// Gets or sets the redirect port override.
+    /// </summary>
+    public int? PortOverride { get; set; }
+
+    /// <summary>
+    /// Gets or sets a value indicating whether the new, more descriptive paths are to be used.
+    /// </summary>
+    public bool NewPath { get; set; }
+
    /// <summary>
    /// Gets or sets a mapping of canonical names from the provider to jellyfin user ids.
    /// </summary>
@@ -250,6 +265,21 @@ public class OidConfig
    /// </summary>
    public string DefaultProvider { get; set; }

+    /// <summary>
+    /// Gets or sets the redirect scheme override.
+    /// </summary>
+    public string SchemeOverride { get; set; }
+
+    /// <summary>
+    /// Gets or sets the redirect port override.
+    /// </summary>
+    public int? PortOverride { get; set; }
+
+    /// <summary>
+    /// Gets or sets a value indicating whether the new, more descriptive paths are to be used.
+    /// </summary>
+    public bool NewPath { get; set; }
+
    /// <summary>
    /// Gets or sets a mapping of canonical names from the provider to jellyfin user ids.
    /// </summary>
@@ -273,10 +303,35 @@ public class OidConfig
    /// </summary>
    public string DefaultUsernameClaim { get; set; }

+    /// <summary>
+    /// Gets or sets the URL format of the new user avatar.
+    /// </summary>
+    public string AvatarUrlFormat { get; set; }
+
    /// <summary>
    /// Gets or sets a value indicating whether HTTPS in the discovery endpoint is required.
    /// </summary>
-    public bool RequireHttps { get; set; }
+    public bool DisableHttps { get; set; }
+
+    /// <summary>
+    /// Gets or sets a value indicating whether pushed authorization is required.
+    /// </summary>
+    public bool DisablePushedAuthorization { get; set; }
+
+    /// <summary>
+    /// Gets or sets a value indicating whether the OpenID endpoints are validated.
+    /// </summary>
+    public bool DoNotValidateEndpoints { get; set; }
+
+    /// <summary>
+    /// Gets or sets a value indicating whether the OpenID issuer name is validated.
+    /// </summary>
+    public bool DoNotValidateIssuerName { get; set; }
+
+    /// <summary>
+    /// Gets or sets a value indicating whether the UserInfo endpoint is used to get profile data.
+    /// </summary>
+    public bool DoNotLoadProfile { get; set; }
 }

 /// <summary>
@@ -301,12 +301,20 @@ const ssoConfigurationPage = {

        form_elements.text_fields.forEach((id) => {
          const value = page.querySelector("#" + id).value;
-          if (value) current_config[id] = page.querySelector("#" + id).value;
+          if (value) {
+            current_config[id] = page.querySelector("#" + id).value;
+          } else {
+            current_config[id] = null;
+          }
        });

        form_elements.json_fields.forEach((id) => {
          const value = page.querySelector("#" + id).value;
-          if (value) current_config[id] = JSON.parse(value);
+          if (value) {
+            current_config[id] = JSON.parse(value);
+          } else {
+            current_config[id] = null;
+          }
        });

        form_elements.check_fields.forEach((id) => {
@@ -73,7 +73,7 @@
              <div class="collapseContent">
                <div class="selectContainer">
                  <label class="selectLabel" for="selectProvider"
-                    >Name of OID Provider:
+                    >Name of OpenID Provider:
                  </label>
                  <select
                    is="emby-select"
@@ -123,7 +123,7 @@
                  <label
                    class="inputLabel inputLabelUnfocused"
                    for="OidProviderName"
-                    >Name of OID Provider:</label
+                    >Name of OpenID Provider:</label
                  >
                  <input
                    is="emby-input"
@@ -133,20 +133,20 @@
                    class="sso-text"
                  />
                  <div class="fieldDescription">
-                    The name used by Jellyfin to identify the OID provider.
+                    The name used by Jellyfin to identify the OpenID provider.
                    <br />
-                    If an OID provider with a matching name does not exist, a
+                    If an OpenID provider with a matching name does not exist, a
                    new provider with this name will be created.
                    <br />
-                    If an OID provider with a matching name already exists, the
-                    settings for that provider will be updated.
+                    If an OpenID provider with a matching name already exists,
+                    the settings for that provider will be updated.
                  </div>
                </div>
                <div class="inputContainer">
                  <label
                    class="inputLabel inputLabelUnfocused"
                    for="OidEndpoint"
-                    >OID Endpoint:</label
+                    >OpenID Endpoint:</label
                  >
                  <input
                    is="emby-input"
@@ -181,7 +181,7 @@
                </div>
                <div class="inputContainer">
                  <label class="inputLabel inputLabelUnfocused" for="OidSecret"
-                    >OID Secret:</label
+                    >OpenID client secret:</label
                  >
                  <input
                    is="emby-input"
@@ -191,7 +191,7 @@
                    class="sso-text"
                  />
                  <div class="fieldDescription">
-                    The OpenID secret. Randomly generated & shared.
+                    The OpenID client secret. Randomly generated & shared.
                  </div>
                </div>

@@ -447,7 +447,7 @@
                    <input
                      is="emby-checkbox"
                      id="EnableLiveTvManagement"
-                      name="EnableLiveTv"
+                      name="EnableLiveTvManagement"
                      type="checkbox"
                      class="sso-toggle"
                    />
@@ -480,7 +480,9 @@
                    list of strings from the OIDC server.
                    <br />
                    For Keycloak, it is <code>realm_access.roles</code> by
-                    default.
+                    default for realm roles. For client roles, it is
+                    <code>resource_access.&gt;clientId&lt;.roles</code>
+                    (e.g. resource_access.jellyfin.roles)
                    <br />
                    For Authelia, it is <code>groups</code>
                  </div>
@@ -559,6 +561,134 @@
                  </div>
                </div>

+                <div class="inputContainer">
+                  <label
+                    class="inputLabel inputLabelUnfocused"
+                    for="AvatarUrlFormat"
+                    >Set avatar url format</label
+                  >
+                  <input
+                    is="emby-input"
+                    id="AvatarUrlFormat"
+                    type="text"
+                    class="sso-text"
+                  />
+                  <div class="fieldDescription">
+                    The url of the avatar with sso variable format: example :
+                    <code>https://example.com/@{user_id}.png</code>
+                  </div>
+                </div>
+
+                <div class="checkboxContainer">
+                  <label>
+                    <input
+                      is="emby-checkbox"
+                      id="DisableHttps"
+                      name="DisableHttps"
+                      type="checkbox"
+                      class="sso-toggle"
+                    />
+                    <span>Disable OpenID HTTPS Discovery (Insecure)</span>
+                  </label>
+                  <div class="fieldDescription checkboxFieldDescription"></div>
+                </div>
+
+                <div class="checkboxContainer">
+                  <label>
+                    <input
+                      is="emby-checkbox"
+                      id="DisablePushedAuthorization"
+                      name="DisablePushedAuthorization"
+                      type="checkbox"
+                      class="sso-toggle"
+                    />
+                    <span
+                      >Disable Pushed Authorization (Insecure). May be needed
+                      for Authelia.</span
+                    >
+                  </label>
+                  <div class="fieldDescription checkboxFieldDescription"></div>
+                </div>
+
+                <div
+                  class="checkboxContainer checkboxContainer-withDescription"
+                >
+                  <label>
+                    <input
+                      is="emby-checkbox"
+                      id="DoNotValidateEndpoints"
+                      name="DoNotValidateEndpoints"
+                      type="checkbox"
+                      class="sso-toggle"
+                    />
+                    <span>Do Not Validate OpenID Endpoints (Insecure)</span>
+                  </label>
+                  <div class="fieldDescription checkboxFieldDescription">
+                    May be required for Google OpenID
+                  </div>
+                </div>
+                <div class="checkboxContainer">
+                  <label>
+                    <input
+                      is="emby-checkbox"
+                      id="DoNotValidateIssuerName"
+                      name="DoNotValidateIssuerName"
+                      type="checkbox"
+                      class="sso-toggle"
+                    />
+                    <span>Do Not Validate OpenID Issuer Name (Insecure)</span>
+                  </label>
+                </div>
+                <div
+                  class="checkboxContainer checkboxContainer-withDescription"
+                >
+                  <label>
+                    <input
+                      is="emby-checkbox"
+                      id="DoNotLoadProfile"
+                      name="DoNotLoadProfile"
+                      type="checkbox"
+                      class="sso-toggle"
+                    />
+                    <span>Do Not Load Profile Information</span>
+                  </label>
+                  <div class="fieldDescription checkboxFieldDescription">
+                    May be required for Cloudflare OpenID
+                  </div>
+                </div>
+
+                <div class="inputContainer">
+                  <label class="inputLabel inputLabelUnfocused" for="RoleClaim"
+                    >Scheme Override</label
+                  >
+                  <input
+                    is="emby-input"
+                    id="SchemeOverride"
+                    type="text"
+                    class="sso-text"
+                  />
+                  <div class="fieldDescription">
+                    If the plugin is redirecting to an insecure URL, set this to
+                    "https"
+                  </div>
+                </div>
+
+                <div class="inputContainer">
+                  <label class="inputLabel inputLabelUnfocused" for="RoleClaim"
+                    >Port Override</label
+                  >
+                  <input
+                    is="emby-input"
+                    id="PortOverride"
+                    type="text"
+                    class="sso-text"
+                  />
+                  <div class="fieldDescription">
+                    If the plugin is redirecting to an incorrect port, set this
+                    to the appropiate port
+                  </div>
+                </div>
+
                <button
                  id="SaveProvider"
                  is="emby-button"
@@ -61,14 +61,14 @@
              is="emby-linkbutton"
              href="https://github.com/9p4/jellyfin-plugin-sso"
              class="button-link"
-              >help page</a
+              >homepage</a
            >
            and
            <a
              is="emby-linkbutton"
-              href="https://github.com/9p4/jellyfin-plugin-sso/projects/1"
+              href="https://github.com/9p4/jellyfin-plugin-sso/issues"
              class="button-link"
-              >roadmap
+              >issue tracker
            </a>
            for more information.
          </p>
@@ -1,10 +1,10 @@
 <Project Sdk="Microsoft.NET.Sdk">

  <PropertyGroup>
-    <TargetFramework>net6.0</TargetFramework>
+    <TargetFramework>net10.0</TargetFramework>
    <RootNamespace>Jellyfin.Plugin.SSO_Auth</RootNamespace>
-    <AssemblyVersion>3.3.0.0</AssemblyVersion>
-    <FileVersion>3.3.0.0</FileVersion>
+    <AssemblyVersion>5.0.0.0</AssemblyVersion>
+    <FileVersion>5.0.0.0</FileVersion>
    <GenerateDocumentationFile>true</GenerateDocumentationFile>
    <TreatWarningsAsErrors>false</TreatWarningsAsErrors>
  </PropertyGroup>
@@ -29,16 +29,21 @@

  <ItemGroup>
    <FrameworkReference Include="Microsoft.AspNetCore.App" />
-    <PackageReference Include="IdentityModel.OidcClient" Version="5.0.0" />
-    <PackageReference Include="Jellyfin.Controller" Version="10.*-*" />
-    <PackageReference Include="Jellyfin.Model" Version="10.*-*" />
-    <PackageReference Include="Newtonsoft.Json" Version="13.0.1" />
-    <PackageReference Include="System.Security.Cryptography.Xml" Version="6.0.0" />
+    <PackageReference Include="Duende.IdentityModel.OidcClient" Version="6.0.1" />
+    <PackageReference Include="Jellyfin.Controller" Version="12.0.0" />
+    <PackageReference Include="Jellyfin.Model" Version="12.0.0" />
+    <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
+    <!-- Compile-only: the server supplies this assembly, so this version must track the server's. Shipping it would load a second copy into the plugin load context. -->
+    <PackageReference Include="StackExchange.Redis" Version="2.13.17" ExcludeAssets="runtime" Private="false" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <InternalsVisibleTo Include="SSO-Auth.Tests" />
  </ItemGroup>

  <ItemGroup>
    <PackageReference Include="SerilogAnalyzer" Version="0.15.0" PrivateAssets="All" />
-    <PackageReference Include="StyleCop.Analyzers" Version="1.2.0-beta.376" PrivateAssets="All" />
+    <PackageReference Include="StyleCop.Analyzers" Version="1.2.0-beta.556" PrivateAssets="all" />
    <PackageReference Include="SmartAnalyzers.MultithreadingAnalyzer" Version="1.1.31" PrivateAssets="All" />
  </ItemGroup>

@@ -61,7 +61,7 @@ public class Response
    /// <param name="certificateBytes">The certificate formatted as an array of bytes.</param>
    public Response(byte[] certificateBytes)
    {
-        _certificate = new X509Certificate2(certificateBytes);
+        _certificate = X509CertificateLoader.LoadCertificate(certificateBytes);
    }

    /// <summary>
@@ -0,0 +1,44 @@
+using System;
+using Jellyfin.Plugin.SSO_Auth.State;
+using MediaBrowser.Controller;
+using MediaBrowser.Controller.Plugins;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using StackExchange.Redis;
+
+namespace Jellyfin.Plugin.SSO_Auth;
+
+/// <summary>
+/// Registers the plugin's services. The OAuth state store is backed by the shared cache the server
+/// already connects to when one is configured, which is what lets a login start on one server instance
+/// and be completed on another.
+/// </summary>
+public class SsoAuthServiceRegistrator : IPluginServiceRegistrator
+{
+    /// <inheritdoc />
+    public void RegisterServices(IServiceCollection serviceCollection, IServerApplicationHost applicationHost)
+    {
+        ArgumentNullException.ThrowIfNull(serviceCollection);
+
+        serviceCollection.AddSingleton<ISsoStateStore>(sp =>
+        {
+            var logger = sp.GetRequiredService<ILoggerFactory>().CreateLogger<SsoAuthServiceRegistrator>();
+            var multiplexer = sp.GetService<IConnectionMultiplexer>();
+
+            if (multiplexer is null)
+            {
+                logger.LogWarning(
+                    "SSO OAuth state store: {Store}. Logins must start and finish on the same server instance.",
+                    nameof(InMemorySsoStateStore));
+
+                return new InMemorySsoStateStore();
+            }
+
+            logger.LogInformation(
+                "SSO OAuth state store: {Store}. Logins are shared across server instances.",
+                nameof(RedisSsoStateStore));
+
+            return new RedisSsoStateStore(multiplexer);
+        });
+    }
+}
@@ -0,0 +1,48 @@
+using System;
+using System.Collections.Generic;
+using System.Threading.Tasks;
+using Jellyfin.Plugin.SSO_Auth.Api;
+
+namespace Jellyfin.Plugin.SSO_Auth.State;
+
+/// <summary>
+/// Stores the in-flight OpenID authorization states of a login or linking flow.
+/// </summary>
+public interface ISsoStateStore
+{
+    /// <summary>
+    /// Stores a newly prepared authorization state.
+    /// </summary>
+    /// <param name="state">The state to store, keyed on its OpenID state value.</param>
+    /// <param name="expiry">How long the state remains usable.</param>
+    /// <returns>A task representing the write.</returns>
+    Task CreateAsync(TimedAuthorizeState state, TimeSpan expiry);
+
+    /// <summary>
+    /// Reads an authorization state without removing it.
+    /// </summary>
+    /// <param name="state">The OpenID state value.</param>
+    /// <returns>The stored state, or <c>null</c> when it is unknown or expired.</returns>
+    Task<TimedAuthorizeState> GetAsync(string state);
+
+    /// <summary>
+    /// Persists mutations made to an authorization state and refreshes its expiry.
+    /// </summary>
+    /// <param name="state">The state to persist, keyed on its OpenID state value.</param>
+    /// <param name="expiry">How long the state remains usable.</param>
+    /// <returns>A task representing the write.</returns>
+    Task UpdateAsync(TimedAuthorizeState state, TimeSpan expiry);
+
+    /// <summary>
+    /// Reads an authorization state and removes it in the same operation, so it can only be redeemed once.
+    /// </summary>
+    /// <param name="state">The OpenID state value.</param>
+    /// <returns>The stored state, or <c>null</c> when it is unknown, expired or already redeemed.</returns>
+    Task<TimedAuthorizeState> ConsumeAsync(string state);
+
+    /// <summary>
+    /// Lists every authorization state currently in flight.
+    /// </summary>
+    /// <returns>The states in flight.</returns>
+    Task<IReadOnlyList<TimedAuthorizeState>> ListAsync();
+}
@@ -0,0 +1,134 @@
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using Jellyfin.Plugin.SSO_Auth.Api;
+
+namespace Jellyfin.Plugin.SSO_Auth.State;
+
+/// <summary>
+/// A process-local <see cref="ISsoStateStore"/> used when the server has no shared cache configured.
+/// States are held serialized so that this store and <see cref="RedisSsoStateStore"/> behave identically:
+/// a mutation is only visible to a later leg of the flow once it has been written back.
+/// </summary>
+public sealed class InMemorySsoStateStore : ISsoStateStore
+{
+    /// <summary>
+    /// The most states this store keeps. The endpoint that creates them is unauthenticated, so the store
+    /// is capped as well as swept; past the cap the states closest to expiring are dropped first.
+    /// Every state carries the same expiry, so that is the oldest state: the cap trades unbounded growth
+    /// for a login DoS, where enough anonymous starts evict the in-flight logins of real users.
+    /// </summary>
+    public const int Capacity = 1024;
+
+    private readonly ConcurrentDictionary<string, Entry> _entries = new ConcurrentDictionary<string, Entry>(StringComparer.Ordinal);
+
+    /// <summary>
+    /// Gets the number of states currently held.
+    /// </summary>
+    public int Count => _entries.Count;
+
+    /// <inheritdoc />
+    public Task CreateAsync(TimedAuthorizeState state, TimeSpan expiry)
+    {
+        return WriteAsync(state, expiry);
+    }
+
+    /// <inheritdoc />
+    public Task UpdateAsync(TimedAuthorizeState state, TimeSpan expiry)
+    {
+        return WriteAsync(state, expiry);
+    }
+
+    /// <inheritdoc />
+    public Task<TimedAuthorizeState> GetAsync(string state)
+    {
+        if (string.IsNullOrEmpty(state) || !_entries.TryGetValue(state, out var entry))
+        {
+            return Task.FromResult<TimedAuthorizeState>(null);
+        }
+
+        if (IsExpired(entry))
+        {
+            _entries.TryRemove(state, out _);
+            return Task.FromResult<TimedAuthorizeState>(null);
+        }
+
+        return Task.FromResult(SsoStateSerializer.Deserialize(entry.Payload));
+    }
+
+    /// <inheritdoc />
+    public Task<TimedAuthorizeState> ConsumeAsync(string state)
+    {
+        if (string.IsNullOrEmpty(state) || !_entries.TryRemove(state, out var entry) || IsExpired(entry))
+        {
+            return Task.FromResult<TimedAuthorizeState>(null);
+        }
+
+        return Task.FromResult(SsoStateSerializer.Deserialize(entry.Payload));
+    }
+
+    /// <inheritdoc />
+    public Task<IReadOnlyList<TimedAuthorizeState>> ListAsync()
+    {
+        var states = new List<TimedAuthorizeState>();
+
+        foreach (var pair in _entries)
+        {
+            if (IsExpired(pair.Value))
+            {
+                _entries.TryRemove(pair.Key, out _);
+                continue;
+            }
+
+            var parsed = SsoStateSerializer.Deserialize(pair.Value.Payload);
+            if (parsed is not null)
+            {
+                states.Add(parsed);
+            }
+        }
+
+        return Task.FromResult<IReadOnlyList<TimedAuthorizeState>>(states);
+    }
+
+    private static bool IsExpired(Entry entry)
+    {
+        return entry.ExpiresAt <= DateTimeOffset.UtcNow;
+    }
+
+    private Task WriteAsync(TimedAuthorizeState state, TimeSpan expiry)
+    {
+        ArgumentNullException.ThrowIfNull(state);
+
+        _entries[state.State.State] = new Entry(SsoStateSerializer.Serialize(state), DateTimeOffset.UtcNow.Add(expiry));
+        Evict();
+        return Task.CompletedTask;
+    }
+
+    private void Evict()
+    {
+        foreach (var pair in _entries)
+        {
+            if (IsExpired(pair.Value))
+            {
+                _entries.TryRemove(pair.Key, out _);
+            }
+        }
+
+        // ConcurrentDictionary.ToArray() is a locked snapshot; LINQ buffering throws if a write races it.
+        var snapshot = _entries.ToArray();
+        var excess = snapshot.Length - Capacity;
+        if (excess <= 0)
+        {
+            return;
+        }
+
+        foreach (var pair in snapshot.OrderBy(p => p.Value.ExpiresAt).Take(excess))
+        {
+            _entries.TryRemove(pair.Key, out _);
+        }
+    }
+
+    private sealed record Entry(string Payload, DateTimeOffset ExpiresAt);
+}
@@ -0,0 +1,115 @@
+using System;
+using System.Collections.Generic;
+using System.Threading.Tasks;
+using Jellyfin.Plugin.SSO_Auth.Api;
+using StackExchange.Redis;
+
+namespace Jellyfin.Plugin.SSO_Auth.State;
+
+/// <summary>
+/// A Redis/Valkey backed <see cref="ISsoStateStore"/>. Every login-path operation addresses a single
+/// key so the store works unchanged against a cluster-mode deployment, and expiry is a key TTL rather
+/// than a sweep, so a state times out even if no further login ever happens.
+/// </summary>
+public sealed class RedisSsoStateStore : ISsoStateStore
+{
+    /// <summary>
+    /// The prefix every OpenID state key is stored under.
+    /// </summary>
+    public const string KeyPrefix = "jellyfin:sso:oid:state:";
+
+    private readonly IConnectionMultiplexer _redis;
+    private readonly IDatabase _database;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="RedisSsoStateStore"/> class.
+    /// </summary>
+    /// <param name="redis">The connection multiplexer shared with the server.</param>
+    public RedisSsoStateStore(IConnectionMultiplexer redis)
+    {
+        ArgumentNullException.ThrowIfNull(redis);
+
+        _redis = redis;
+        _database = redis.GetDatabase();
+    }
+
+    /// <inheritdoc />
+    public Task CreateAsync(TimedAuthorizeState state, TimeSpan expiry)
+    {
+        return WriteAsync(state, expiry);
+    }
+
+    /// <inheritdoc />
+    public Task UpdateAsync(TimedAuthorizeState state, TimeSpan expiry)
+    {
+        return WriteAsync(state, expiry);
+    }
+
+    /// <inheritdoc />
+    public async Task<TimedAuthorizeState> GetAsync(string state)
+    {
+        if (string.IsNullOrEmpty(state))
+        {
+            return null;
+        }
+
+        var payload = await _database.StringGetAsync(KeyFor(state)).ConfigureAwait(false);
+        return SsoStateSerializer.Deserialize(payload);
+    }
+
+    /// <inheritdoc />
+    public async Task<TimedAuthorizeState> ConsumeAsync(string state)
+    {
+        if (string.IsNullOrEmpty(state))
+        {
+            return null;
+        }
+
+        var payload = await _database.StringGetDeleteAsync(KeyFor(state)).ConfigureAwait(false);
+        return SsoStateSerializer.Deserialize(payload);
+    }
+
+    /// <inheritdoc />
+    public async Task<IReadOnlyList<TimedAuthorizeState>> ListAsync()
+    {
+        var states = new List<TimedAuthorizeState>();
+
+        foreach (var endpoint in _redis.GetEndPoints())
+        {
+            var server = _redis.GetServer(endpoint);
+            if (!server.IsConnected || server.IsReplica)
+            {
+                continue;
+            }
+
+            await foreach (var key in server.KeysAsync(pattern: KeyPrefix + "*").ConfigureAwait(false))
+            {
+                var parsed = SsoStateSerializer.Deserialize(await _database.StringGetAsync(key).ConfigureAwait(false));
+                if (parsed is not null)
+                {
+                    states.Add(parsed);
+                }
+            }
+        }
+
+        return states;
+    }
+
+    private static RedisKey KeyFor(string state)
+    {
+        return KeyPrefix + state;
+    }
+
+    private Task WriteAsync(TimedAuthorizeState state, TimeSpan expiry)
+    {
+        ArgumentNullException.ThrowIfNull(state);
+
+        return _database.StringSetAsync(
+            KeyFor(state.State.State),
+            SsoStateSerializer.Serialize(state),
+            expiry,
+            keepTtl: false,
+            when: When.Always,
+            flags: CommandFlags.None);
+    }
+}
@@ -0,0 +1,92 @@
+using System;
+using System.Collections.Generic;
+using Jellyfin.Plugin.SSO_Auth.Api;
+
+namespace Jellyfin.Plugin.SSO_Auth.State;
+
+/// <summary>
+/// A redacted view of an in-flight authorization state. The PKCE code verifier and the authorization
+/// URL derived from it are deliberately omitted so that listing flows cannot leak them.
+/// </summary>
+public class SsoStateInfo
+{
+    /// <summary>
+    /// Gets or sets the OpenID state value.
+    /// </summary>
+    public string State { get; set; }
+
+    /// <summary>
+    /// Gets or sets the redirect URI the provider calls back to.
+    /// </summary>
+    public string RedirectUri { get; set; }
+
+    /// <summary>
+    /// Gets or sets when the flow started.
+    /// </summary>
+    public DateTime Created { get; set; }
+
+    /// <summary>
+    /// Gets or sets a value indicating whether the flow has been validated.
+    /// </summary>
+    public bool Valid { get; set; }
+
+    /// <summary>
+    /// Gets or sets the user tied to the flow.
+    /// </summary>
+    public string Username { get; set; }
+
+    /// <summary>
+    /// Gets or sets a value indicating whether the user is an administrator.
+    /// </summary>
+    public bool Admin { get; set; }
+
+    /// <summary>
+    /// Gets or sets a value indicating whether the flow links an existing account.
+    /// </summary>
+    public bool IsLinking { get; set; }
+
+    /// <summary>
+    /// Gets or sets the folders the user is allowed access to.
+    /// </summary>
+    public IReadOnlyList<string> Folders { get; set; }
+
+    /// <summary>
+    /// Gets or sets a value indicating whether the user is allowed to view live TV.
+    /// </summary>
+    public bool EnableLiveTv { get; set; }
+
+    /// <summary>
+    /// Gets or sets a value indicating whether the user is allowed to manage live TV.
+    /// </summary>
+    public bool EnableLiveTvManagement { get; set; }
+
+    /// <summary>
+    /// Gets or sets the user avatar url.
+    /// </summary>
+    public string AvatarURL { get; set; }
+
+    /// <summary>
+    /// Projects a stored state onto its redacted view.
+    /// </summary>
+    /// <param name="state">The stored state.</param>
+    /// <returns>The redacted view.</returns>
+    public static SsoStateInfo FromState(TimedAuthorizeState state)
+    {
+        ArgumentNullException.ThrowIfNull(state);
+
+        return new SsoStateInfo
+        {
+            State = state.State?.State,
+            RedirectUri = state.State?.RedirectUri,
+            Created = state.Created,
+            Valid = state.Valid,
+            Username = state.Username,
+            Admin = state.Admin,
+            IsLinking = state.IsLinking,
+            Folders = state.Folders,
+            EnableLiveTv = state.EnableLiveTv,
+            EnableLiveTvManagement = state.EnableLiveTvManagement,
+            AvatarURL = state.AvatarURL
+        };
+    }
+}
@@ -0,0 +1,36 @@
+using Jellyfin.Plugin.SSO_Auth.Api;
+using Newtonsoft.Json;
+
+namespace Jellyfin.Plugin.SSO_Auth.State;
+
+/// <summary>
+/// Converts <see cref="TimedAuthorizeState"/> to and from the representation held by a state store.
+/// </summary>
+public static class SsoStateSerializer
+{
+    private static readonly JsonSerializerSettings Settings = new JsonSerializerSettings
+    {
+        NullValueHandling = NullValueHandling.Include,
+        DateTimeZoneHandling = DateTimeZoneHandling.RoundtripKind
+    };
+
+    /// <summary>
+    /// Serializes an authorization state.
+    /// </summary>
+    /// <param name="state">The state to serialize.</param>
+    /// <returns>The serialized state.</returns>
+    public static string Serialize(TimedAuthorizeState state)
+    {
+        return JsonConvert.SerializeObject(state, Settings);
+    }
+
+    /// <summary>
+    /// Deserializes an authorization state.
+    /// </summary>
+    /// <param name="payload">The serialized state, which may be null or empty.</param>
+    /// <returns>The state, or <c>null</c> when there is nothing to deserialize.</returns>
+    public static TimedAuthorizeState Deserialize(string payload)
+    {
+        return string.IsNullOrEmpty(payload) ? null : JsonConvert.DeserializeObject<TimedAuthorizeState>(payload, Settings);
+    }
+}
@@ -83,4 +83,4 @@ public class SSOViewsController : ControllerBase
    {
        return ServeView(viewName);
    }
-}
+}
@@ -240,36 +240,42 @@ Emby Button
 /* fonts.scss */

 html {
-  font-family: "Noto Sans", "Noto Sans HK", "Noto Sans JP", "Noto Sans KR",
-    "Noto Sans SC", "Noto Sans TC", sans-serif;
+  font-family:
+    "Noto Sans", "Noto Sans HK", "Noto Sans JP", "Noto Sans KR", "Noto Sans SC",
+    "Noto Sans TC", sans-serif;
  text-size-adjust: 100%;
  -webkit-font-smoothing: antialiased;
  text-rendering: optimizeLegibility;
 }

 html[lang|="ja"] {
-  font-family: "Noto Sans", "Noto Sans JP", "Noto Sans HK", "Noto Sans KR",
-    "Noto Sans SC", "Noto Sans TC", sans-serif;
+  font-family:
+    "Noto Sans", "Noto Sans JP", "Noto Sans HK", "Noto Sans KR", "Noto Sans SC",
+    "Noto Sans TC", sans-serif;
 }

 html[lang|="ko"] {
-  font-family: "Noto Sans", "Noto Sans KR", "Noto Sans HK", "Noto Sans JP",
-    "Noto Sans SC", "Noto Sans TC", sans-serif;
+  font-family:
+    "Noto Sans", "Noto Sans KR", "Noto Sans HK", "Noto Sans JP", "Noto Sans SC",
+    "Noto Sans TC", sans-serif;
 }

 html[lang|="zh-CN"] {
-  font-family: "Noto Sans", "Noto Sans SC", "Noto Sans HK", "Noto Sans JP",
-    "Noto Sans KR", "Noto Sans TC", sans-serif;
+  font-family:
+    "Noto Sans", "Noto Sans SC", "Noto Sans HK", "Noto Sans JP", "Noto Sans KR",
+    "Noto Sans TC", sans-serif;
 }

 html[lang|="zh-TW"] {
-  font-family: "Noto Sans", "Noto Sans TC", "Noto Sans HK", "Noto Sans JP",
-    "Noto Sans KR", "Noto Sans SC", sans-serif;
+  font-family:
+    "Noto Sans", "Noto Sans TC", "Noto Sans HK", "Noto Sans JP", "Noto Sans KR",
+    "Noto Sans SC", sans-serif;
 }

 html[lang|="zh-HK"] {
-  font-family: "Noto Sans", "Noto Sans HK", "Noto Sans JP", "Noto Sans KR",
-    "Noto Sans SC", "Noto Sans TC", sans-serif;
+  font-family:
+    "Noto Sans", "Noto Sans HK", "Noto Sans JP", "Noto Sans KR", "Noto Sans SC",
+    "Noto Sans TC", sans-serif;
 }

 .layout-tv {
@@ -1,3 +1,5 @@
+using System.Globalization;
+
 namespace Jellyfin.Plugin.SSO_Auth;

 /// <summary>
@@ -9,7 +11,16 @@ public static class WebResponse
    /// The shared HTML between all of the responses.
    /// </summary>
    public static readonly string Base = @"<!DOCTYPE html>
-<html><head></head><body>
+<html><head>
+<meta name='viewport' content='width=device-width, initial-scale=1'>
+<style>
+  body {
+    background: #101010;
+    color: #d1cfce;
+    font-family: Noto Sans, Noto Sans HK, Noto Sans JP, Noto Sans KR, Noto Sans SC, Noto Sans TC, sans-serif;
+  }
+</style>
+</head><body>
 <p>Logging in...</p>
 <noscript>Please enable Javascript to complete the login</noscript>
 <script>
@@ -35,25 +46,14 @@ function isTv() {
        return true;
    }

-    if (isWeb0s()) {
-        return true;
-    }
-
-    return false;
+    return isWeb0s();
 }

 function isWeb0s() {
    const userAgent = navigator.userAgent.toLowerCase();

-    if (userAgent.indexOf('netcast') !== -1) {
-        return true;
-    }
-
-    if (userAgent.indexOf('web0s') !== -1) {
-        return true;
-    }
-
-    return false;
+    return userAgent.indexOf('netcast') !== -1
+        || userAgent.indexOf('web0s') !== -1;
 }

 function isMobile(userAgent) {
@@ -100,11 +100,7 @@ function hasKeyboard(browser) {
        return true;
    }

-    if (browser.tv) {
-        return true;
-    }
-
-    return false;
+    return !!browser.tv;
 }

 function iOSversion() {
@@ -147,8 +143,12 @@ function web0sVersion(browser) {

        // The next is only valid for the app

-        if (browser.versionMajor >= 79) {
-      return 6;
+        if (browser.versionMajor >= 94) {
+            return 23;
+        } else if (browser.versionMajor >= 87) {
+            return 22;
+        } else if (browser.versionMajor >= 79) {
+            return 6;
        } else if (browser.versionMajor >= 68) {
            return 5;
        } else if (browser.versionMajor >= 53) {
@@ -179,14 +179,11 @@ let _supportsCssAnimation;
 let _supportsCssAnimationWithPrefix;
 function supportsCssAnimation(allowPrefix) {
    // TODO: Assess if this is still needed, as all of our targets should natively support CSS animations.
-    if (allowPrefix) {
-        if (_supportsCssAnimationWithPrefix === true || _supportsCssAnimationWithPrefix === false) {
-            return _supportsCssAnimationWithPrefix;
-        }
-    } else {
-        if (_supportsCssAnimation === true || _supportsCssAnimation === false) {
-            return _supportsCssAnimation;
-        }
+    if (allowPrefix && (_supportsCssAnimationWithPrefix === true || _supportsCssAnimationWithPrefix === false)) {
+        return _supportsCssAnimationWithPrefix;
+    }
+    if (_supportsCssAnimation === true || _supportsCssAnimation === false) {
+        return _supportsCssAnimation;
    }

    let animation = false;
@@ -198,8 +195,8 @@ function supportsCssAnimation(allowPrefix) {
    }

    if (animation === false && allowPrefix) {
-        for (let i = 0; i < domPrefixes.length; i++) {
-            if (elm.style[domPrefixes[i] + 'AnimationName'] !== undefined) {
+        for (const domPrefix of domPrefixes) {
+            if (elm.style[domPrefix + 'AnimationName'] !== undefined) {
                animation = true;
                break;
            }
@@ -218,25 +215,25 @@ function supportsCssAnimation(allowPrefix) {
 const uaMatch = function (ua) {
    ua = ua.toLowerCase();

-    const match = /(edg)[ /]([\w.]+)/.exec(ua) ||
-        /(edga)[ /]([\w.]+)/.exec(ua) ||
-        /(edgios)[ /]([\w.]+)/.exec(ua) ||
-        /(edge)[ /]([\w.]+)/.exec(ua) ||
-        /(opera)[ /]([\w.]+)/.exec(ua) ||
-        /(opr)[ /]([\w.]+)/.exec(ua) ||
-        /(chrome)[ /]([\w.]+)/.exec(ua) ||
-        /(safari)[ /]([\w.]+)/.exec(ua) ||
-        /(firefox)[ /]([\w.]+)/.exec(ua) ||
-        ua.indexOf('compatible') < 0 && /(mozilla)(?:.*? rv:([\w.]+)|)/.exec(ua) ||
-        [];
+    const match = /(chrome)[ /]([\w.]+)/.exec(ua)
+        || /(edg)[ /]([\w.]+)/.exec(ua)
+        || /(edga)[ /]([\w.]+)/.exec(ua)
+        || /(edgios)[ /]([\w.]+)/.exec(ua)
+        || /(edge)[ /]([\w.]+)/.exec(ua)
+        || /(opera)[ /]([\w.]+)/.exec(ua)
+        || /(opr)[ /]([\w.]+)/.exec(ua)
+        || /(safari)[ /]([\w.]+)/.exec(ua)
+        || /(firefox)[ /]([\w.]+)/.exec(ua)
+        || ua.indexOf('compatible') < 0 && /(mozilla)(?:.*? rv:([\w.]+)|)/.exec(ua)
+        || [];

    const versionMatch = /(version)[ /]([\w.]+)/.exec(ua);

-    let platform_match = /(ipad)/.exec(ua) ||
-        /(iphone)/.exec(ua) ||
-        /(windows)/.exec(ua) ||
-        /(android)/.exec(ua) ||
-        [];
+    let platform_match = /(ipad)/.exec(ua)
+        || /(iphone)/.exec(ua)
+        || /(windows)/.exec(ua)
+        || /(android)/.exec(ua)
+        || [];

    let browser = match[1] || '';

@@ -255,7 +252,7 @@ const uaMatch = function (ua) {

    version = version || match[2] || '0';

-    let versionMajor = parseInt(version.split('.')[0]);
+    let versionMajor = parseInt(version.split('.')[0], 10);

    if (isNaN(versionMajor)) {
        versionMajor = 0;
@@ -313,7 +310,9 @@ if (userAgent.toLowerCase().indexOf('xbox') !== -1) {
    browser.tv = true;
 }
 browser.animate = typeof document !== 'undefined' && document.documentElement.animate != null;
+browser.hisense = userAgent.toLowerCase().includes('hisense');
 browser.tizen = userAgent.toLowerCase().indexOf('tizen') !== -1 || window.tizen != null;
+browser.vidaa = userAgent.toLowerCase().includes('vidaa');
 browser.web0s = isWeb0s();
 browser.edgeUwp = browser.edge && (userAgent.toLowerCase().indexOf('msapphost') !== -1 || userAgent.toLowerCase().indexOf('webview') !== -1);

@@ -324,7 +323,7 @@ if (browser.web0s) {
    delete browser.safari;

    const v = (navigator.appVersion).match(/Tizen (\d+).(\d+)/);
-    browser.tizenVersion = parseInt(v[1]);
+    browser.tizenVersion = parseInt(v[1], 10);
 } else {
    browser.orsay = userAgent.toLowerCase().indexOf('smarthub') !== -1;
 }
@@ -340,11 +339,9 @@ if (browser.mobile || browser.tv) {
    browser.slow = true;
 }

-if (typeof document !== 'undefined') {
-    /* eslint-disable-next-line compat/compat */
-    if (('ontouchstart' in window) || (navigator.maxTouchPoints > 0)) {
-        browser.touch = true;
-    }
+/* eslint-disable-next-line compat/compat */
+if (typeof document !== 'undefined' && ('ontouchstart' in window) || (navigator.maxTouchPoints > 0)) {
+    browser.touch = true;
 }

 browser.keyboard = hasKeyboard(browser);
@@ -361,39 +358,41 @@ if (browser.iOS) {
 }

 function getDeviceName() {
-    var deviceName = '';
-    if (browser.tizen) {
-        deviceName = 'Samsung Smart TV';
-    } else if (browser.web0s) {
-        deviceName = 'LG Smart TV';
-    } else if (browser.operaTv) {
-        deviceName = 'Opera TV';
-    } else if (browser.xboxOne) {
-        deviceName = 'Xbox One';
-    } else if (browser.ps4) {
-        deviceName = 'Sony PS4';
-    } else if (browser.chrome) {
-        deviceName = 'Chrome';
-    } else if (browser.edgeChromium) {
-        deviceName = 'Edge Chromium';
-    } else if (browser.edge) {
-        deviceName = 'Edge';
-    } else if (browser.firefox) {
-        deviceName = 'Firefox';
-    } else if (browser.opera) {
-        deviceName = 'Opera';
-    } else if (browser.safari) {
-        deviceName = 'Safari';
-    } else {
-        deviceName = 'Web Browser';
-    }
+	var deviceName = '';
+    if (!deviceName) {
+        if (browser.tizen) {
+            deviceName = 'Samsung Smart TV';
+        } else if (browser.web0s) {
+            deviceName = 'LG Smart TV';
+        } else if (browser.operaTv) {
+            deviceName = 'Opera TV';
+        } else if (browser.xboxOne) {
+            deviceName = 'Xbox One';
+        } else if (browser.ps4) {
+            deviceName = 'Sony PS4';
+        } else if (browser.chrome) {
+            deviceName = 'Chrome';
+        } else if (browser.edgeChromium) {
+            deviceName = 'Edge Chromium';
+        } else if (browser.edge) {
+            deviceName = 'Edge';
+        } else if (browser.firefox) {
+            deviceName = 'Firefox';
+        } else if (browser.opera) {
+            deviceName = 'Opera';
+        } else if (browser.safari) {
+            deviceName = 'Safari';
+        } else {
+            deviceName = 'Web Browser';
+        }

-    if (browser.ipad) {
-        deviceName += ' iPad';
-    } else if (browser.iphone) {
-        deviceName += ' iPhone';
-    } else if (browser.android) {
-        deviceName += ' Android';
+        if (browser.ipad) {
+            deviceName += ' iPad';
+        } else if (browser.iphone) {
+            deviceName += ' iPhone';
+        } else if (browser.android) {
+            deviceName += ' Android';
+        }
    }

    return deviceName;
@@ -416,6 +415,14 @@ const sleep = (milliseconds) => {
    /// <returns>A string with the HTML to serve to the client.</returns>
    public static string Generator(string data, string provider, string baseUrl, string mode, bool isLinking = false)
    {
+        // Strip out the protocol (http:// or https://) and convert the domain to Punycode
+        var idnMapping = new IdnMapping();
+        var protocolSeparatorIndex = baseUrl.IndexOf("//");
+        var protocol = baseUrl.Substring(0, protocolSeparatorIndex + 2);
+        var domain = baseUrl.Substring(protocolSeparatorIndex + 2);
+        var punycodeDomain = idnMapping.GetAscii(domain);
+        var punycodeBaseUrl = protocol + punycodeDomain;
+
        return Base + @"
 async function link(request) {
    const jfCredentialsString = localStorage.getItem(""jellyfin_credentials"");
@@ -429,7 +436,7 @@ async function link(request) {
    if (jfUser == null) return;
    if (jfToken == null) return;

-    const url = '" + $"{baseUrl}/sso/{mode}/Link/{provider}/" + @"' + jfUser;
+    const url = '" + $"{punycodeBaseUrl}/sso/{mode}/Link/{provider}/" + @"' + jfUser;

    return new Promise(resolve => {
       var xhr = new XMLHttpRequest();
@@ -453,6 +460,9 @@ async function link(request) {
 }

 async function main() {
+    localStorage.removeItem('jellyfin_credentials');
+    document.getElementById('iframe-main').src = '" + punycodeBaseUrl + @"/web/index.html';
+
    var data = '" + data + @"';
    while (localStorage.getItem(""_deviceId2"") == null ||
        localStorage.getItem(""jellyfin_credentials"") == null ||
@@ -469,7 +479,7 @@ async function main() {

    if (" + $"{isLinking}".ToLower() + @") await link(request);

-    var url = '" + baseUrl + "/sso/" + mode + "/Auth/" + provider + @"';
+    var url = '" + punycodeBaseUrl + "/sso/" + mode + "/Auth/" + provider + @"';

    let response = await new Promise(resolve => {
       var xhr = new XMLHttpRequest();
@@ -493,7 +503,7 @@ async function main() {
    jfCreds['Servers'][0]['UserId'] = responseJson['User']['Id'];
    localStorage.setItem('jellyfin_credentials', JSON.stringify(jfCreds));
    localStorage.setItem('enableAutoLogin', 'true');
-    window.location.replace('" + baseUrl + @"');
+    window.location.replace('" + punycodeBaseUrl + @"/web/index.html');
 }

 document.addEventListener('DOMContentLoaded', function () {
@@ -501,6 +511,6 @@ document.addEventListener('DOMContentLoaded', function () {
 });

 // https://stackoverflow.com/a/25435165
-</script><iframe class='docs-texteventtarget-iframe' sandbox='allow-same-origin allow-forms allow-scripts' src='" + baseUrl + "' style='position: absolute;width:0;height:0;border:0;'></iframe></body></html>";
+</script><iframe id='iframe-main' class='docs-texteventtarget-iframe' sandbox='allow-same-origin allow-forms allow-scripts' src='' style='position: absolute;width:0;height:0;border:0;'></iframe></body></html>";
    }
 }
@@ -1,10 +1,10 @@
 name: "SSO Authentication"
 guid: "505ce9d1-d916-42fa-86ca-673ef241d7df"
 imageUrl: "https://raw.githubusercontent.com/9p4/jellyfin-plugin-sso/main/img/logo.png"
-version: "3.5.0.0"
-targetAbi: "10.8.0.0"
-framework: "net6.0"
-owner: "9p4"
+version: "5.0.0.0"
+targetAbi: "12.0.0.0"
+framework: "net10.0"
+owner: "unkin"
 overview: "Authenticate users against an SSO provider."
 description: |
  This plugin allows users to sign in through an SSO provider (such as Google, Facebook, or your own provider). This enables one-click signin.
@@ -12,9 +12,20 @@ description: |
 category: "Authentication"
 artifacts:
  - "SSO-Auth.dll"
-  - "IdentityModel.OidcClient.dll"
-  - "IdentityModel.dll"
+  - "Duende.IdentityModel.OidcClient.dll"
+  - "Duende.IdentityModel.dll"
 changelog: |
+  5.0.0.0: Jellyfin 12.0
+  4.0.0.4: Fix security issue in SAML
+  4.0.0.0: Jellyfin 10.11
+  3.5.3.0: Allow for OID-provided avatars, various bugfixes and workarounds
+  3.5.2.4: Updates for Jellyfin 10.9
+  3.5.2.3: Improve OpenID discovery policy security rules, fix iOS login bugs related to cache
+  3.5.2.2: Fix linking page when using new paths
+  3.5.2.1: Hotfix for SAML null checks
+  3.5.2.0: Allow overriding the scheme used for generating URLs.
+  3.5.1.1: Change iframe URL to point to the web UI instead of the root 
+  3.5.1.0: Improved paths! No more obscure "p" versus "r" URLs! Improve final redirect for automatic authentication. Add more configuration options for OpenID discovery.
  3.5.0.0: Add support for Live TV authentication. Fix various null pointer bugs.
  3.4.0.0: Add user self-service for linking existing accounts + managing existing links. Allow IDP accounts to be linked to jellyfin accounts with a different display-name.
  3.3.0.0: Add fallback authentication provider. Add OpenID admin page.
@@ -2,11 +2,11 @@
  "nodes": {
    "nixpkgs": {
      "locked": {
-        "lastModified": 1691218994,
-        "narHash": "sha256-46GJ5vLf9H+Oh7Jii2gJI9GATJHGbx2iQpon5nUSFPI=",
+        "lastModified": 1760934318,
+        "narHash": "sha256-/oUYsC0lUCBory65VK+UHqCCsCspbL1Vgfcf1KUYqVw=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "0d2fb29f5071a12d7983319c2c2576be6a130582",
+        "rev": "87848bf0cc4f87717fc813a4575f07330c3e743c",
        "type": "github"
      },
      "original": {
@@ -5,6 +5,6 @@
    let pkgs = nixpkgs.legacyPackages.x86_64-linux;
    in {
      devShell.x86_64-linux =
-        pkgs.mkShell { buildInputs = [ pkgs.nodePackages.prettier pkgs.dotnet-sdk ]; };
+        pkgs.mkShell { buildInputs = [ pkgs.nodePackages.prettier pkgs.dotnet-sdk_9 ]; };
   };
 }
@@ -1,68 +1,75 @@
 <?xml version="1.0" encoding="utf-8"?>
-<RuleSet Name="Rules for Jellyfin.Server" Description="Code analysis rules for Jellyfin.Server.csproj" ToolsVersion="14.0">
-  <Rules AnalyzerId="StyleCop.Analyzers" RuleNamespace="StyleCop.Analyzers">
-    <!-- disable warning SA1202: 'public' members must come before 'private' members -->
-    <Rule Id="SA1202" Action="Info" />
-    <!-- disable warning SA1204: Static members must appear before non-static members -->
-    <Rule Id="SA1204" Action="Info" />
-    <!-- disable warning SA1404: Code analysis suppression should have justification -->
-    <Rule Id="SA1404" Action="Info" />
+<RuleSet Name="Rules for Jellyfin.Server"
+	Description="Code analysis rules for Jellyfin.Server.csproj" ToolsVersion="14.0">
+	<Rules AnalyzerId="StyleCop.Analyzers" RuleNamespace="StyleCop.Analyzers">
+		<!-- disable warning SA1202: 'public' members must come before 'private' members -->
+		<Rule Id="SA1202" Action="Info" />
+		<!-- disable warning SA1204: Static members must appear before non-static members -->
+		<Rule Id="SA1204" Action="Info" />
+		<!-- disable warning SA1404: Code analysis suppression should have justification -->
+		<Rule Id="SA1404" Action="Info" />

-    <!-- disable warning SA1009: Closing parenthesis should be followed by a space. -->
-    <Rule Id="SA1009" Action="None" />
-    <!-- disable warning SA1101: Prefix local calls with 'this.' -->
-    <Rule Id="SA1101" Action="None" />
-    <!-- disable warning SA1108: Block statements should not contain embedded comments -->
-    <Rule Id="SA1108" Action="None" />
-    <!-- disable warning SA1128:: Put constructor initializers on their own line -->
-    <Rule Id="SA1128" Action="None" />
-    <!-- disable warning SA1130: Use lambda syntax -->
-    <Rule Id="SA1130" Action="None" />
-    <!-- disable warning SA1200: 'using' directive must appear within a namespace declaration -->
-    <Rule Id="SA1200" Action="None" />
-    <!-- disable warning SA1309: Fields must not begin with an underscore -->
-    <Rule Id="SA1309" Action="None" />
-    <!-- disable warning SA1413: Use trailing comma in multi-line initializers -->
-    <Rule Id="SA1413" Action="None" />
-    <!-- disable warning SA1512: Single-line comments must not be followed by blank line -->
-    <Rule Id="SA1512" Action="None" />
-    <!-- disable warning SA1515: Single-line comment should be preceded by blank line -->
-    <Rule Id="SA1515" Action="None" />
-    <!-- disable warning SA1600: Elements should be documented -->
-    <Rule Id="SA1600" Action="None" />
-    <!-- disable warning SA1633: The file header is missing or not located at the top of the file -->
-    <Rule Id="SA1633" Action="None" />
-  </Rules>
+		<!-- disable warning SA1009: Closing parenthesis should be followed by a space. -->
+		<Rule Id="SA1009" Action="None" />
+		<!-- disable warning SA1101: Prefix local calls with 'this.' -->
+		<Rule Id="SA1101" Action="None" />
+		<!-- disable warning SA1108: Block statements should not contain embedded comments -->
+		<Rule Id="SA1108" Action="None" />
+		<!-- disable warning SA1128:: Put constructor initializers on their own line -->
+		<Rule Id="SA1128" Action="None" />
+		<!-- disable warning SA1130: Use lambda syntax -->
+		<Rule Id="SA1130" Action="None" />
+		<!-- disable warning SA1200: 'using' directive must appear within a namespace declaration -->
+		<Rule Id="SA1200" Action="None" />
+		<!-- disable warning SA1309: Fields must not begin with an underscore -->
+		<Rule Id="SA1309" Action="None" />
+		<!-- disable warning SA1402: File may only contain a single type  -->
+		<Rule Id="SA1402" Action="None" />
+		<!-- disable warning SA1413: Use trailing comma in multi-line initializers -->
+		<Rule Id="SA1413" Action="None" />
+		<!-- disable warning SA1512: Single-line comments must not be followed by blank line -->
+		<Rule Id="SA1512" Action="None" />
+		<!-- disable warning SA1515: Single-line comment should be preceded by blank line -->
+		<Rule Id="SA1515" Action="None" />
+		<!-- disable warning SA1600: Elements should be documented -->
+		<Rule Id="SA1600" Action="None" />
+		<!-- disable warning SA1633: The file header is missing or not located at the top of the
+		file -->
+		<Rule Id="SA1633" Action="None" />
+		<!-- disable warning SA1649: File name should match first type name -->
+		<Rule Id="SA1649" Action="None" />
+	</Rules>

-  <Rules AnalyzerId="Microsoft.CodeAnalysis.FxCopAnalyzers" RuleNamespace="Microsoft.Design">
-    <!-- disable warning CA1031: Do not catch general exception types -->
-    <Rule Id="CA1031" Action="Info" />
-    <!-- disable warning CA1032: Implement standard exception constructors -->
-    <Rule Id="CA1032" Action="Info" />
-    <!-- disable warning CA1062: Validate arguments of public methods -->
-    <Rule Id="CA1062" Action="Info" />
-    <!-- disable warning CA1716: Identifiers should not match keywords -->
-    <Rule Id="CA1716" Action="Info" />
-    <!-- disable warning CA1720: Identifiers should not contain type names -->
-    <Rule Id="CA1720" Action="Info" />
-    <!-- disable warning CA1812: internal class that is apparently never instantiated.
+	<Rules AnalyzerId="Microsoft.CodeAnalysis.FxCopAnalyzers" RuleNamespace="Microsoft.Design">
+		<!-- disable warning CA1031: Do not catch general exception types -->
+		<Rule Id="CA1031" Action="Info" />
+		<!-- disable warning CA1032: Implement standard exception constructors -->
+		<Rule Id="CA1032" Action="Info" />
+		<!-- disable warning CA1062: Validate arguments of public methods -->
+		<Rule Id="CA1062" Action="Info" />
+		<!-- disable warning CA1716: Identifiers should not match keywords -->
+		<Rule Id="CA1716" Action="Info" />
+		<!-- disable warning CA1720: Identifiers should not contain type names -->
+		<Rule Id="CA1720" Action="Info" />
+		<!-- disable warning CA1812: internal class that is apparently never instantiated.
        If so, remove the code from the assembly.
        If this class is intended to contain only static members, make it static -->
-    <Rule Id="CA1812" Action="Info" />
-    <!-- disable warning CA1822: Member does not access instance data and can be marked as static -->
-    <Rule Id="CA1822" Action="Info" />
-    <!-- disable warning CA2000: Dispose objects before losing scope -->
-    <Rule Id="CA2000" Action="Info" />
+		<Rule Id="CA1812" Action="Info" />
+		<!-- disable warning CA1822: Member does not access instance data and can be marked as
+		static -->
+		<Rule Id="CA1822" Action="Info" />
+		<!-- disable warning CA2000: Dispose objects before losing scope -->
+		<Rule Id="CA2000" Action="Info" />

-    <!-- disable warning CA1054: Change the type of parameter url from string to System.Uri -->
-    <Rule Id="CA1054" Action="None" />
-    <!-- disable warning CA1055: URI return values should not be strings -->
-    <Rule Id="CA1055" Action="None" />
-    <!-- disable warning CA1056: URI properties should not be strings -->
-    <Rule Id="CA1056" Action="None" />
-    <!-- disable warning CA1303: Do not pass literals as localized parameters -->
-    <Rule Id="CA1303" Action="None" />
-    <!-- disable warning CA1308: Normalize strings to uppercase -->
-    <Rule Id="CA1308" Action="None" />
-  </Rules>
+		<!-- disable warning CA1054: Change the type of parameter url from string to System.Uri -->
+		<Rule Id="CA1054" Action="None" />
+		<!-- disable warning CA1055: URI return values should not be strings -->
+		<Rule Id="CA1055" Action="None" />
+		<!-- disable warning CA1056: URI properties should not be strings -->
+		<Rule Id="CA1056" Action="None" />
+		<!-- disable warning CA1303: Do not pass literals as localized parameters -->
+		<Rule Id="CA1303" Action="None" />
+		<!-- disable warning CA1308: Normalize strings to uppercase -->
+		<Rule Id="CA1308" Action="None" />
+	</Rules>
 </RuleSet>
@@ -2,6 +2,8 @@

 This plugin has been tested to work against various providers, though not all providers provide support for all of this plugins' features.

+❗ Before you proceed, make sure you have another admin account if you are going to link SSO provider to the only admin account on the server, permission might get overwritten (see [#212](https://github.com/9p4/jellyfin-plugin-sso/issues/212)).
+
 ## TOC / Tested Providers:

 This section is broken into providers that support Role-Based Access Control (RBAC), and those that do not
@@ -10,13 +12,15 @@ This section is broken into providers that support Role-Based Access Control (RB

 - ✅ [Authelia](#authelia)
 - ✅ [authentik](#authentik)
- [✅ Keycloak](#keycloak-oidc)
+- ✅ [Keycloak](#keycloak-oidc)
  - Both [OIDC](#keycloak-oidc) & [SAML](#keycloak-saml)
+- ✅ [Pocket ID](#pocket-id)

 ### No RBAC Support

 - ✅ Google OIDC
  - ❗ Usernames are numeric
+  - ❗ Requires disabling validating OpenID endpoints

 ## General Options, when RBAC is supported

@@ -41,6 +45,25 @@ Authelia is simple to configure, and RBAC is straightforward.

 Below is the `identity_providers` section of an Authelia config:

+### Authelia v4.38 and above
+
+```yaml
+identity_providers:
+  oidc:
+    # hmac secret and private key given by env variables
+    clients:
+      - client_id: jellyfin
+        client_name: My media server
+        # Client secret should be randomly generated
+        client_secret: <redacted>
+        token_endpoint_auth_method: client_secret_post
+        authorization_policy: one_factor
+        redirect_uris:
+          - https://jellyfin.example.com/sso/OID/redirect/authelia
+```
+
+### Authelia v4.37 and below
+
 ```yaml
 identity_providers:
  oidc:
@@ -52,7 +75,7 @@ identity_providers:
        secret: <redacted>
        authorization_policy: one_factor
        redirect_uris:
-          - https://jellyfin.example.com/sso/OID/r/authelia
+          - https://jellyfin.example.com/sso/OID/redirect/authelia
 ```

 ### Jellyfin's Config
@@ -68,6 +91,7 @@ authelia:
  OidSecret: <redacted>
  RoleClaim: groups
  OidScopes: ["groups"]
+  DisablePushedAuthorization: true
 ```

 ## authentik
@@ -113,7 +137,7 @@ Now we can add this property mapping to authentik's Jellyfin OAuth provider:
  ![image](img/authentik-config-04.jpg)

 - Edit / Update your Jellyfin OAuth provider
- Verify your **"Redirect URIs/Origins (RegEx)"** follows the format: `https://domain.tld/sso/OID/r/Authentik`.
+- Verify your **"Redirect URIs/Origins (RegEx)"** follows the format: `https://domain.tld/sso/OID/redirect/Authentik`.
 - Under **"Advanced Protocol Settings"**, add the **Group Membership** Scope

  ![image](img/authentik-config-05.jpg)
@@ -133,6 +157,8 @@ authentik:
  OidScopes: ["groups"]
 ```

+If you recieve the error `Error processing request.` from Jellyfin when attempting to login and the Jellyfin logs show `Error loading discovery document: Endpoint belongs to different authority` try setting `Do not validate endpoints` in the plugin settings.
+
 ## Keycloak OIDC

 Keycloak in general is a little more complicated than other providers. Ensure that you have a realm created and have some usable users.
@@ -145,7 +171,8 @@ Ensure that the following configuration options are set:

 - Access Type: Confidential
 - Standard Flow Enabled
- Redirect URI: https://myjellyfin.example.com/sso/OID/r/PROVIDER_NAME
+- Redirect URI: https://myjellyfin.example.com/sso/OID/redirect/PROVIDER_NAME
+- Redirect URI (for Android app): org.jellyfin.mobile://login-callback
 - Base URL: https://myjellyfin.example.com

 Press the "Save" button at the bottom of the page and open the "Credentials" tab. Note down the secret.
@@ -179,9 +206,9 @@ Ensure that the following configuration options are set:
 - Sign Documents on
 - Sign Assertions off
 - Client Signature Required off
- Redirect URI: [https://myjellyfin.example.com/sso/SAML/p/PROVIDER_NAME](https://myjellyfin.example.com/sso/SAML/p/PROVIDER_NAME)
+- Redirect URI: [https://myjellyfin.example.com/sso/SAML/start/PROVIDER_NAME](https://myjellyfin.example.com/sso/SAML/start/PROVIDER_NAME)
 - Base URL: [https://myjellyfin.example.com](https://myjellyfin.example.com)
- Master SAML processing URL: [https://myjellyfin.example.com/sso/SAML/p/PROVIDER_NAME](https://myjellyfin.example.com/sso/SAML/p/PROVIDER_NAME)
+- Master SAML processing URL: [https://myjellyfin.example.com/sso/SAML/start/PROVIDER_NAME](https://myjellyfin.example.com/sso/SAML/start/PROVIDER_NAME)

 Press the "Save" button at the bottom of the page.

@@ -199,3 +226,80 @@ keycloak:
  SamlClientId: <same-as-in-keycloak>
  SamlCertificate: <copied-from-xml-file>
 ```
+
+## Pocket ID
+
+A simple and easy-to-use OIDC provider that allows users to authenticate with their passkeys to your services.
+
+### Pocket ID Config
+
+1. Login to you Pocket ID admin account
+1. Go to `Administration -> OCID Clients`
+1. Click `Add OCID Client`
+1. Give the client a name e.g. `Jellyfin`
+1. Set the `Clent Launch URL` to your Jellyfin endpoint
+1. Set the callbak url to `https://jellyfin.example.com/sso/OID/redirect/pocketid`. The `pocketid` part must match the `Name of OpenID Provider` in the Jellyfin SSO provider
+1. (optional) Enable PKCE if Jellyfin is an https endpoint
+1. (optional) Set a logo
+1. (optional) Set `Allowed User Groups`
+
+### Jellyfin's Config
+
+```yaml
+pocketid:
+  OidEndpoint: https://pocketid.example.com/.well-known/openid-configuration
+  OidClientId: <pocket-id-client-id>
+  OidSecret: <pocket-id-secret>
+  EnableAuthorization: true # (optional) If you want Jellyfin to read group permissions from pocket id
+  RoleClaim: groups # (optional) If you want Jellyfin to be able to read group assignments from pocket id
+  AdminRoles: admin # (optional) The pocket id group which will give a user Jellyfin admin privilges
+  Roles: users  # (optional) The pocket id group which will give a user Jellyfin access
+  AvatarUrlFormat: @{picture} # (optional) This will pull each users pocket id photo into Jellyfin
+```
+
+## Kanidm
+
+Kanidm is a modern and simple identity management platform written in rust.
+
+### Kanidm Config
+
+```shell
+kanidm system oauth2 create jellyfin "Jellyfin" https://jellyfin.example.com/
+
+# Set this to drop the trailing @idm.example.com in usernames
+kanidm system oauth2 prefer-short-username jellyfin
+
+kanidm system oauth2 add-redirect-url jellyfin https://jellyfin.example.com/sso/OID/redirect/kanidm
+kanidm system oauth2 add-redirect-url jellyfin https://jellyfin.example.com/sso/OID/r/kanidm
+
+# Optionally setup groups for Jellyfin
+kanidm group create jellyfin_admins
+kanidm group create jellyfin_users
+
+kanidm system oauth2 update-scope-map jellyfin jellyfin_admins openid profile groups
+kanidm system oauth2 update-scope-map jellyfin jellyfin_users openid profile groups
+```
+
+Get the secret used in the Jellyfin config with `kanidm system oauth2 show-basic-secret jellyfin`.
+
+### Jellyfin's Config
+
+```yaml
+kanidm:
+  OidEndpoint: https://idm.example.com/oauth2/openid/jellyfin/
+  OidClientId: jellyfin
+  OidSecret: <kanidm-secret>
+  # (optional) If you want Jellyfin to read group permissions from kanidm
+  EnableAuthorization: true
+  OidScopes:
+    - groups
+  RoleClaim: groups
+  AdminsRoles:
+    - jellyfin_admins@idm.example.com
+  Roles:
+    - jellyfin_users@idm.example.com
+    # If in your setup admin accounts aren't members of the users group you need to add the admins group to roles as well
+    - jellyfin_admins@idm.example.com
+  # (optional) If you want the name attribute instead of the spn attribute as username
+  DefaultUsernameClaim: preferred_username
+```
@@ -0,0 +1,143 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using Duende.IdentityModel.OidcClient;
+using Jellyfin.Plugin.SSO_Auth.Api;
+using Jellyfin.Plugin.SSO_Auth.State;
+using Xunit;
+
+namespace Jellyfin.Plugin.SSO_Auth.Tests;
+
+public class InMemorySsoStateStoreTests
+{
+    private static readonly TimeSpan Expiry = TimeSpan.FromSeconds(300);
+
+    [Fact]
+    public async Task GetAsync_WhenUnknown_ReturnsNull()
+    {
+        Assert.Null(await new InMemorySsoStateStore().GetAsync("nope"));
+    }
+
+    [Fact]
+    public async Task Mutations_AreOnlyVisibleOnceWrittenBack()
+    {
+        var store = new InMemorySsoStateStore();
+        await store.CreateAsync(NewState("abc123"), Expiry);
+
+        var dropped = await store.GetAsync("abc123");
+        dropped.Valid = true;
+        dropped.Username = "mallory";
+
+        // Not written back, so the mutation must not be observable.
+        var reread = await store.GetAsync("abc123");
+        Assert.False(reread.Valid);
+        Assert.Null(reread.Username);
+
+        reread.Valid = true;
+        reread.Username = "alice";
+        reread.Admin = true;
+        reread.Folders = new List<string> { "movies" };
+        await store.UpdateAsync(reread, Expiry);
+
+        var redeemed = await store.ConsumeAsync("abc123");
+        Assert.True(redeemed.Valid);
+        Assert.Equal("alice", redeemed.Username);
+        Assert.True(redeemed.Admin);
+        Assert.Equal(new[] { "movies" }, redeemed.Folders);
+    }
+
+    [Fact]
+    public async Task ConsumeAsync_RedeemsOnlyOnce()
+    {
+        var store = new InMemorySsoStateStore();
+        await store.CreateAsync(NewState("abc123"), Expiry);
+
+        Assert.NotNull(await store.ConsumeAsync("abc123"));
+        Assert.Null(await store.ConsumeAsync("abc123"));
+        Assert.Null(await store.GetAsync("abc123"));
+    }
+
+    [Fact]
+    public async Task ExpiredState_IsNotReturned()
+    {
+        var store = new InMemorySsoStateStore();
+        await store.CreateAsync(NewState("abc123"), TimeSpan.FromMilliseconds(-1));
+
+        Assert.Null(await store.GetAsync("abc123"));
+        Assert.Empty(await store.ListAsync());
+    }
+
+    [Fact]
+    public async Task ListAsync_ReturnsLiveStates()
+    {
+        var store = new InMemorySsoStateStore();
+        await store.CreateAsync(NewState("abc123"), Expiry);
+        await store.CreateAsync(NewState("def456"), Expiry);
+
+        var states = await store.ListAsync();
+
+        Assert.Equal(2, states.Count);
+    }
+
+    [Fact]
+    public async Task Writing_SweepsExpiredEntriesOutOfTheStore()
+    {
+        var store = new InMemorySsoStateStore();
+        await store.CreateAsync(NewState("stale1"), TimeSpan.FromMilliseconds(-1));
+        await store.CreateAsync(NewState("stale2"), TimeSpan.FromMilliseconds(-1));
+        await store.CreateAsync(NewState("stale3"), TimeSpan.FromMilliseconds(-1));
+
+        await store.CreateAsync(NewState("live"), Expiry);
+
+        Assert.Equal(1, store.Count);
+    }
+
+    [Fact]
+    public async Task Writing_BoundsTheStoreAtItsCapacity()
+    {
+        var store = new InMemorySsoStateStore();
+
+        for (var i = 0; i < InMemorySsoStateStore.Capacity + 64; i++)
+        {
+            await store.CreateAsync(NewState($"state{i}"), Expiry);
+        }
+
+        Assert.Equal(InMemorySsoStateStore.Capacity, store.Count);
+    }
+
+    [Fact]
+    public async Task Writing_AtCapacity_IsSafeUnderConcurrency()
+    {
+        var store = new InMemorySsoStateStore();
+
+        for (var i = 0; i < InMemorySsoStateStore.Capacity; i++)
+        {
+            await store.CreateAsync(NewState($"seed{i}"), Expiry);
+        }
+
+        const int Writers = 8;
+
+        var writers = Enumerable.Range(0, Writers).Select(writer => Task.Run(async () =>
+        {
+            for (var i = 0; i < 2000; i++)
+            {
+                var state = NewState($"w{writer}-{i}");
+                await store.CreateAsync(state, Expiry);
+                await store.UpdateAsync(state, Expiry);
+            }
+        }));
+
+        await Task.WhenAll(writers);
+
+        // Each in-flight writer can miss or repeat one eviction, so the cap holds to within the writer count.
+        Assert.InRange(store.Count, InMemorySsoStateStore.Capacity - Writers, InMemorySsoStateStore.Capacity + Writers);
+    }
+
+    private static TimedAuthorizeState NewState(string state)
+    {
+        return new TimedAuthorizeState(
+            new AuthorizeState { State = state, CodeVerifier = "code-verifier-secret" },
+            DateTime.UtcNow);
+    }
+}
@@ -0,0 +1,219 @@
+using System;
+using System.Collections.Generic;
+using System.Net;
+using System.Threading.Tasks;
+using Duende.IdentityModel.OidcClient;
+using Jellyfin.Plugin.SSO_Auth.Api;
+using Jellyfin.Plugin.SSO_Auth.State;
+using Moq;
+using StackExchange.Redis;
+using Xunit;
+
+namespace Jellyfin.Plugin.SSO_Auth.Tests;
+
+public class RedisSsoStateStoreTests
+{
+    [Fact]
+    public async Task CreateAsync_WritesPrefixedKeyWithExpiry()
+    {
+        var db = new Mock<IDatabase>();
+        RedisKey key = default;
+        RedisValue value = default;
+        TimeSpan? expiry = null;
+        SetupStringSet(db, (k, v, e) =>
+        {
+            key = k;
+            value = v;
+            expiry = e;
+        });
+
+        var store = new RedisSsoStateStore(CreateMultiplexer(db.Object));
+        await store.CreateAsync(NewState("abc123"), TimeSpan.FromSeconds(300));
+
+        Assert.Equal("jellyfin:sso:oid:state:abc123", key.ToString());
+        Assert.Equal(TimeSpan.FromSeconds(300), expiry);
+        Assert.Contains("abc123", value.ToString(), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task UpdateAsync_RefreshesExpiry()
+    {
+        var db = new Mock<IDatabase>();
+        TimeSpan? expiry = null;
+        SetupStringSet(db, (k, v, e) => expiry = e);
+
+        var store = new RedisSsoStateStore(CreateMultiplexer(db.Object));
+        await store.UpdateAsync(NewState("abc123"), TimeSpan.FromSeconds(120));
+
+        Assert.Equal(TimeSpan.FromSeconds(120), expiry);
+    }
+
+    [Fact]
+    public async Task GetAsync_WhenKeyMissing_ReturnsNull()
+    {
+        var db = new Mock<IDatabase>();
+        db.Setup(d => d.StringGetAsync(It.IsAny<RedisKey>(), It.IsAny<CommandFlags>()))
+            .ReturnsAsync(RedisValue.Null);
+
+        var store = new RedisSsoStateStore(CreateMultiplexer(db.Object));
+
+        Assert.Null(await store.GetAsync("missing"));
+    }
+
+    [Fact]
+    public async Task GetAsync_WithoutState_DoesNotTouchRedis()
+    {
+        var db = new Mock<IDatabase>(MockBehavior.Strict);
+        var store = new RedisSsoStateStore(CreateMultiplexer(db.Object));
+
+        Assert.Null(await store.GetAsync(null));
+        Assert.Null(await store.GetAsync(string.Empty));
+    }
+
+    [Fact]
+    public async Task Mutations_WrittenByTheCallback_AreVisibleToTheAuthLeg()
+    {
+        var db = new Mock<IDatabase>();
+        string stored = null;
+        SetupStringSet(db, (k, v, e) => stored = v.ToString());
+        db.Setup(d => d.StringGetAsync(It.IsAny<RedisKey>(), It.IsAny<CommandFlags>()))
+            .ReturnsAsync(() => stored is null ? RedisValue.Null : (RedisValue)stored);
+        db.Setup(d => d.StringGetDeleteAsync(It.IsAny<RedisKey>(), It.IsAny<CommandFlags>()))
+            .ReturnsAsync(() =>
+            {
+                var payload = stored;
+                stored = null;
+                return payload is null ? RedisValue.Null : (RedisValue)payload;
+            });
+
+        var store = new RedisSsoStateStore(CreateMultiplexer(db.Object));
+        var expiry = TimeSpan.FromSeconds(300);
+
+        // Leg 1: the start endpoint stores a freshly prepared state.
+        await store.CreateAsync(NewState("abc123"), expiry);
+
+        // Leg 2: the callback endpoint validates the response and writes its decision back.
+        var callbackState = await store.GetAsync("abc123");
+        Assert.NotNull(callbackState);
+        Assert.False(callbackState.Valid);
+        callbackState.Valid = true;
+        callbackState.Username = "alice";
+        callbackState.Admin = true;
+        callbackState.AvatarURL = "https://idp.example/alice.png";
+        await store.UpdateAsync(callbackState, expiry);
+
+        // Leg 3: the auth endpoint redeems the state and sees the callback's decision.
+        var authState = await store.ConsumeAsync("abc123");
+        Assert.NotNull(authState);
+        Assert.True(authState.Valid);
+        Assert.Equal("alice", authState.Username);
+        Assert.True(authState.Admin);
+        Assert.Equal("https://idp.example/alice.png", authState.AvatarURL);
+        Assert.Equal("code-verifier-secret", authState.State.CodeVerifier);
+
+        // A replay of the same response finds nothing.
+        Assert.Null(await store.ConsumeAsync("abc123"));
+    }
+
+    [Fact]
+    public async Task ConsumeAsync_UsesAnAtomicGetAndDelete()
+    {
+        var db = new Mock<IDatabase>(MockBehavior.Strict);
+        db.Setup(d => d.StringGetDeleteAsync(It.IsAny<RedisKey>(), It.IsAny<CommandFlags>()))
+            .ReturnsAsync(RedisValue.Null);
+
+        var store = new RedisSsoStateStore(CreateMultiplexer(db.Object));
+
+        Assert.Null(await store.ConsumeAsync("abc123"));
+        db.Verify(
+            d => d.StringGetDeleteAsync(
+                It.Is<RedisKey>(k => k.ToString() == "jellyfin:sso:oid:state:abc123"),
+                It.IsAny<CommandFlags>()),
+            Times.Once);
+    }
+
+    [Fact]
+    public async Task ListAsync_ScansPrimariesOnly()
+    {
+        var db = new Mock<IDatabase>();
+        db.Setup(d => d.StringGetAsync(It.IsAny<RedisKey>(), It.IsAny<CommandFlags>()))
+            .ReturnsAsync((RedisValue)SsoStateSerializer.Serialize(NewState("abc123")));
+
+        var primary = CreateServer(isReplica: false, keys: new[] { (RedisKey)"jellyfin:sso:oid:state:abc123" });
+        var replica = CreateServer(isReplica: true, keys: new[] { (RedisKey)"jellyfin:sso:oid:state:abc123" });
+
+        var primaryEndpoint = new DnsEndPoint("primary", 6379);
+        var replicaEndpoint = new DnsEndPoint("replica", 6379);
+
+        var mux = new Mock<IConnectionMultiplexer>();
+        mux.Setup(m => m.GetDatabase(It.IsAny<int>(), It.IsAny<object>())).Returns(db.Object);
+        mux.Setup(m => m.GetEndPoints(It.IsAny<bool>())).Returns(new EndPoint[] { primaryEndpoint, replicaEndpoint });
+        mux.Setup(m => m.GetServer(primaryEndpoint, It.IsAny<object>())).Returns(primary);
+        mux.Setup(m => m.GetServer(replicaEndpoint, It.IsAny<object>())).Returns(replica);
+
+        var states = await new RedisSsoStateStore(mux.Object).ListAsync();
+
+        Assert.Single(states);
+        Assert.Equal("abc123", states[0].State.State);
+    }
+
+    private static TimedAuthorizeState NewState(string state)
+    {
+        return new TimedAuthorizeState(
+            new AuthorizeState
+            {
+                State = state,
+                StartUrl = "https://idp.example/authorize",
+                RedirectUri = "https://jellyfin.example/sso/OID/redirect/authentik",
+                CodeVerifier = "code-verifier-secret"
+            },
+            DateTime.UtcNow);
+    }
+
+    private static void SetupStringSet(Mock<IDatabase> db, Action<RedisKey, RedisValue, TimeSpan?> capture)
+    {
+        db.Setup(d => d.StringSetAsync(
+                It.IsAny<RedisKey>(),
+                It.IsAny<RedisValue>(),
+                It.IsAny<TimeSpan?>(),
+                It.IsAny<bool>(),
+                It.IsAny<When>(),
+                It.IsAny<CommandFlags>()))
+            .Callback<RedisKey, RedisValue, TimeSpan?, bool, When, CommandFlags>(
+                (key, value, expiry, keepTtl, when, flags) => capture(key, value, expiry))
+            .ReturnsAsync(true);
+    }
+
+    private static IServer CreateServer(bool isReplica, IReadOnlyList<RedisKey> keys)
+    {
+        var server = new Mock<IServer>();
+        server.SetupGet(s => s.IsConnected).Returns(true);
+        server.SetupGet(s => s.IsReplica).Returns(isReplica);
+        server.Setup(s => s.KeysAsync(
+                It.IsAny<int>(),
+                It.IsAny<RedisValue>(),
+                It.IsAny<int>(),
+                It.IsAny<long>(),
+                It.IsAny<int>(),
+                It.IsAny<CommandFlags>()))
+            .Returns(ToAsyncEnumerable(keys));
+        return server.Object;
+    }
+
+    private static async IAsyncEnumerable<RedisKey> ToAsyncEnumerable(IReadOnlyList<RedisKey> keys)
+    {
+        foreach (var key in keys)
+        {
+            yield return key;
+        }
+
+        await Task.CompletedTask;
+    }
+
+    private static IConnectionMultiplexer CreateMultiplexer(IDatabase database)
+    {
+        var mux = new Mock<IConnectionMultiplexer>();
+        mux.Setup(m => m.GetDatabase(It.IsAny<int>(), It.IsAny<object>())).Returns(database);
+        return mux.Object;
+    }
+}
@@ -0,0 +1,27 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <RootNamespace>Jellyfin.Plugin.SSO_Auth.Tests</RootNamespace>
+    <OutputType>Exe</OutputType>
+    <IsPackable>false</IsPackable>
+    <TreatWarningsAsErrors>false</TreatWarningsAsErrors>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <FrameworkReference Include="Microsoft.AspNetCore.App" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.9.0" />
+    <PackageReference Include="Moq" Version="4.18.4" />
+    <PackageReference Include="StackExchange.Redis" Version="2.13.17" />
+    <PackageReference Include="xunit.v3" Version="3.2.2" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5">
+      <PrivateAssets>all</PrivateAssets>
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+    </PackageReference>
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\..\SSO-Auth\SSO-Auth.csproj" />
+  </ItemGroup>
+
+</Project>
@@ -0,0 +1,238 @@
+using System;
+using System.IO;
+using System.Net.Http;
+using System.Threading.Tasks;
+using Duende.IdentityModel.OidcClient;
+using Jellyfin.Plugin.SSO_Auth.Api;
+using Jellyfin.Plugin.SSO_Auth.Config;
+using Jellyfin.Plugin.SSO_Auth.State;
+using MediaBrowser.Common.Configuration;
+using MediaBrowser.Controller.Configuration;
+using MediaBrowser.Controller.Library;
+using MediaBrowser.Controller.Net;
+using MediaBrowser.Controller.Providers;
+using MediaBrowser.Controller.Session;
+using MediaBrowser.Model.Cryptography;
+using MediaBrowser.Model.Serialization;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Infrastructure;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Moq;
+using Newtonsoft.Json;
+using Xunit;
+
+namespace Jellyfin.Plugin.SSO_Auth.Tests;
+
+public class SSOControllerTests
+{
+    [Fact]
+    public async Task OidPost_WhenTheStateIsUnknownToTheStore_ReportsAnExpiredState()
+    {
+        ConfigurePlugin();
+        var store = new Mock<ISsoStateStore>();
+        store.Setup(s => s.GetAsync("state-from-another-pod")).ReturnsAsync((TimedAuthorizeState)null);
+
+        var result = await CreateController(store.Object).OidPost("authentik", "state-from-another-pod");
+
+        var badRequest = Assert.IsType<BadRequestObjectResult>(result);
+        Assert.Equal("Invalid or expired state", badRequest.Value);
+    }
+
+    [Fact]
+    public async Task OidStates_DoesNotExposeTheCodeVerifier()
+    {
+        ConfigurePlugin();
+        var state = new TimedAuthorizeState(
+            new AuthorizeState
+            {
+                State = "abc123",
+                StartUrl = "https://idp.example/authorize?code_challenge=abc",
+                RedirectUri = "https://jellyfin.example/sso/OID/redirect/authentik",
+                CodeVerifier = "code-verifier-secret"
+            },
+            DateTime.UtcNow)
+        {
+            Username = "alice"
+        };
+
+        var store = new Mock<ISsoStateStore>();
+        store.Setup(s => s.ListAsync()).ReturnsAsync(new[] { state });
+
+        var result = await CreateController(store.Object).OidStates();
+
+        var ok = Assert.IsType<OkObjectResult>(result);
+        var body = JsonConvert.SerializeObject(ok.Value);
+
+        Assert.DoesNotContain("code-verifier-secret", body, StringComparison.Ordinal);
+        Assert.DoesNotContain("CodeVerifier", body, StringComparison.OrdinalIgnoreCase);
+        Assert.Contains("abc123", body, StringComparison.Ordinal);
+        Assert.Contains("alice", body, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task OidPost_WhenTheStoreIsUnreachable_RejectsTheLoginAndLogsIt()
+    {
+        ConfigurePlugin();
+        var store = new Mock<ISsoStateStore>();
+        store.Setup(s => s.GetAsync(It.IsAny<string>())).ThrowsAsync(new InvalidOperationException("valkey is down"));
+        var logger = new Mock<ILogger<SSOController>>();
+
+        var result = await CreateController(store.Object, logger.Object).OidPost("authentik", "abc123");
+
+        var content = Assert.IsType<ContentResult>(result);
+        Assert.Equal(StatusCodes.Status503ServiceUnavailable, content.StatusCode);
+        AssertLoggedAnError(logger);
+    }
+
+    [Fact]
+    public async Task OidStates_WhenTheStoreIsUnreachable_ReportsItUnavailable()
+    {
+        ConfigurePlugin();
+        var store = new Mock<ISsoStateStore>();
+        store.Setup(s => s.ListAsync()).ThrowsAsync(new InvalidOperationException("valkey is down"));
+
+        var result = await CreateController(store.Object).OidStates();
+
+        var content = Assert.IsType<ContentResult>(result);
+        Assert.Equal(StatusCodes.Status503ServiceUnavailable, content.StatusCode);
+    }
+
+    [Fact]
+    public async Task OidAuth_WhenTheStoreIsUnreachable_DoesNotAuthenticate()
+    {
+        ConfigurePlugin();
+        var store = new Mock<ISsoStateStore>();
+        store.Setup(s => s.ConsumeAsync(It.IsAny<string>())).ThrowsAsync(new InvalidOperationException("valkey is down"));
+        var sessionManager = new Mock<ISessionManager>();
+
+        var result = await CreateController(store.Object, sessionManager: sessionManager)
+            .OidAuth("authentik", new AuthResponse { Data = "abc123" });
+
+        var problem = Assert.IsType<ObjectResult>(result);
+        Assert.Equal(StatusCodes.Status503ServiceUnavailable, problem.StatusCode);
+        sessionManager.VerifyNoOtherCalls();
+    }
+
+    [Fact]
+    public async Task CompleteOidState_WhenTheRoleCheckFailed_DiscardsTheStateInsteadOfExtendingIt()
+    {
+        ConfigurePlugin();
+        var store = new Mock<ISsoStateStore>();
+        var timedState = NewState("abc123");
+
+        var result = await CreateController(store.Object)
+            .CompleteOidState("authentik", "abc123", timedState, "https://jellyfin.example");
+
+        var content = Assert.IsType<ContentResult>(result);
+        Assert.Equal(StatusCodes.Status401Unauthorized, content.StatusCode);
+        store.Verify(s => s.ConsumeAsync("abc123"), Times.Once);
+        store.Verify(s => s.UpdateAsync(It.IsAny<TimedAuthorizeState>(), It.IsAny<TimeSpan>()), Times.Never);
+    }
+
+    [Fact]
+    public async Task CompleteOidState_WhenValid_WritesTheStateBack()
+    {
+        ConfigurePlugin();
+        var store = new Mock<ISsoStateStore>();
+        var timedState = NewState("abc123");
+        timedState.Valid = true;
+
+        var result = await CreateController(store.Object)
+            .CompleteOidState("authentik", "abc123", timedState, "https://jellyfin.example");
+
+        var content = Assert.IsType<ContentResult>(result);
+        Assert.Null(content.StatusCode);
+        store.Verify(s => s.UpdateAsync(timedState, It.IsAny<TimeSpan>()), Times.Once);
+        store.Verify(s => s.ConsumeAsync(It.IsAny<string>()), Times.Never);
+    }
+
+    [Fact]
+    public async Task CompleteOidState_WhenTheWriteBackFails_RejectsTheLogin()
+    {
+        ConfigurePlugin();
+        var store = new Mock<ISsoStateStore>();
+        store.Setup(s => s.UpdateAsync(It.IsAny<TimedAuthorizeState>(), It.IsAny<TimeSpan>()))
+            .ThrowsAsync(new InvalidOperationException("valkey is down"));
+        var timedState = NewState("abc123");
+        timedState.Valid = true;
+
+        var result = await CreateController(store.Object)
+            .CompleteOidState("authentik", "abc123", timedState, "https://jellyfin.example");
+
+        var content = Assert.IsType<ContentResult>(result);
+        Assert.Equal(StatusCodes.Status503ServiceUnavailable, content.StatusCode);
+    }
+
+    private static TimedAuthorizeState NewState(string state)
+    {
+        return new TimedAuthorizeState(
+            new AuthorizeState { State = state, CodeVerifier = "code-verifier-secret" },
+            DateTime.UtcNow);
+    }
+
+    private static void AssertLoggedAnError(Mock<ILogger<SSOController>> logger)
+    {
+        logger.Verify(
+            l => l.Log(
+                LogLevel.Error,
+                It.IsAny<EventId>(),
+                It.IsAny<It.IsAnyType>(),
+                It.IsAny<Exception>(),
+                (Func<It.IsAnyType, Exception, string>)It.IsAny<object>()),
+            Times.Once);
+    }
+
+    private static void ConfigurePlugin()
+    {
+        var root = Path.Combine(Path.GetTempPath(), "sso-auth-tests", Guid.NewGuid().ToString("N"));
+        var paths = new Mock<IApplicationPaths>();
+        paths.SetupGet(p => p.PluginsPath).Returns(root);
+        paths.SetupGet(p => p.PluginConfigurationsPath).Returns(root);
+
+        var plugin = new SSOPlugin(paths.Object, new Mock<IXmlSerializer>().Object);
+        var configuration = new PluginConfiguration();
+        configuration.OidConfigs["authentik"] = new OidConfig { Enabled = true };
+        plugin.UpdateConfiguration(configuration);
+    }
+
+    private static SSOController CreateController(
+        ISsoStateStore store,
+        ILogger<SSOController> logger = null,
+        Mock<ISessionManager> sessionManager = null)
+    {
+        var problemDetailsFactory = new Mock<ProblemDetailsFactory>();
+        problemDetailsFactory
+            .Setup(f => f.CreateProblemDetails(
+                It.IsAny<HttpContext>(),
+                It.IsAny<int?>(),
+                It.IsAny<string>(),
+                It.IsAny<string>(),
+                It.IsAny<string>(),
+                It.IsAny<string>()))
+            .Returns((HttpContext _, int? status, string title, string type, string detail, string instance) =>
+                new ProblemDetails { Status = status, Title = title, Detail = detail });
+
+        var services = new ServiceCollection();
+        services.AddSingleton(problemDetailsFactory.Object);
+
+        return new SSOController(
+            logger ?? new Mock<ILogger<SSOController>>().Object,
+            new Mock<ILoggerFactory>().Object,
+            (sessionManager ?? new Mock<ISessionManager>()).Object,
+            new Mock<IUserManager>().Object,
+            new Mock<IAuthorizationContext>().Object,
+            new Mock<ICryptoProvider>().Object,
+            new Mock<IProviderManager>().Object,
+            new Mock<IHttpClientFactory>().Object,
+            new Mock<IServerConfigurationManager>().Object,
+            store)
+        {
+            ControllerContext = new ControllerContext
+            {
+                HttpContext = new DefaultHttpContext { RequestServices = services.BuildServiceProvider() }
+            }
+        };
+    }
+}
@@ -0,0 +1,47 @@
+using Jellyfin.Plugin.SSO_Auth.State;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Moq;
+using StackExchange.Redis;
+using Xunit;
+
+namespace Jellyfin.Plugin.SSO_Auth.Tests;
+
+public class SsoAuthServiceRegistratorTests
+{
+    [Fact]
+    public void RegisterServices_WithoutAMultiplexer_FallsBackToTheInMemoryStore()
+    {
+        var provider = Register(withMultiplexer: false);
+
+        Assert.IsType<InMemorySsoStateStore>(provider.GetRequiredService<ISsoStateStore>());
+    }
+
+    [Fact]
+    public void RegisterServices_WithAMultiplexer_UsesTheSharedStore()
+    {
+        var provider = Register(withMultiplexer: true);
+
+        Assert.IsType<RedisSsoStateStore>(provider.GetRequiredService<ISsoStateStore>());
+    }
+
+    private static ServiceProvider Register(bool withMultiplexer)
+    {
+        var loggerFactory = new Mock<ILoggerFactory>();
+        loggerFactory.Setup(f => f.CreateLogger(It.IsAny<string>())).Returns(new Mock<ILogger>().Object);
+
+        var services = new ServiceCollection();
+        services.AddSingleton(loggerFactory.Object);
+
+        if (withMultiplexer)
+        {
+            var mux = new Mock<IConnectionMultiplexer>();
+            mux.Setup(m => m.GetDatabase(It.IsAny<int>(), It.IsAny<object>())).Returns(new Mock<IDatabase>().Object);
+            services.AddSingleton(mux.Object);
+        }
+
+        new SsoAuthServiceRegistrator().RegisterServices(services, null);
+
+        return services.BuildServiceProvider();
+    }
+}
@@ -0,0 +1,82 @@
+using System;
+using System.Collections.Generic;
+using Duende.IdentityModel.OidcClient;
+using Jellyfin.Plugin.SSO_Auth.Api;
+using Jellyfin.Plugin.SSO_Auth.State;
+using Xunit;
+
+namespace Jellyfin.Plugin.SSO_Auth.Tests;
+
+public class SsoStateSerializerTests
+{
+    [Fact]
+    public void RoundTrip_PreservesEveryFieldTheFlowDependsOn()
+    {
+        var original = new TimedAuthorizeState(
+            new AuthorizeState
+            {
+                State = "state-value",
+                StartUrl = "https://idp.example/authorize?code_challenge=abc",
+                RedirectUri = "https://jellyfin.example/sso/OID/redirect/authentik",
+                CodeVerifier = "code-verifier-secret"
+            },
+            new DateTime(2026, 9, 19, 10, 30, 0, DateTimeKind.Utc))
+        {
+            Valid = true,
+            Username = "alice",
+            Admin = true,
+            IsLinking = true,
+            Folders = new List<string> { "movies", "shows" },
+            EnableLiveTv = true,
+            EnableLiveTvManagement = true,
+            AvatarURL = "https://idp.example/avatar/alice.png"
+        };
+
+        var restored = SsoStateSerializer.Deserialize(SsoStateSerializer.Serialize(original));
+
+        Assert.NotNull(restored);
+        Assert.Equal("state-value", restored.State.State);
+        Assert.Equal("https://idp.example/authorize?code_challenge=abc", restored.State.StartUrl);
+        Assert.Equal("https://jellyfin.example/sso/OID/redirect/authentik", restored.State.RedirectUri);
+
+        // The code verifier is required to complete the token exchange on the pod that handles the callback.
+        Assert.Equal("code-verifier-secret", restored.State.CodeVerifier);
+
+        Assert.Equal(original.Created, restored.Created);
+        Assert.True(restored.Valid);
+        Assert.Equal("alice", restored.Username);
+        Assert.True(restored.Admin);
+        Assert.True(restored.IsLinking);
+        Assert.Equal(new[] { "movies", "shows" }, restored.Folders);
+        Assert.True(restored.EnableLiveTv);
+        Assert.True(restored.EnableLiveTvManagement);
+        Assert.Equal("https://idp.example/avatar/alice.png", restored.AvatarURL);
+    }
+
+    [Fact]
+    public void RoundTrip_PreservesNulls()
+    {
+        var original = new TimedAuthorizeState(
+            new AuthorizeState { State = "state-value", CodeVerifier = null, RedirectUri = null, StartUrl = null },
+            DateTime.UtcNow);
+
+        var restored = SsoStateSerializer.Deserialize(SsoStateSerializer.Serialize(original));
+
+        Assert.NotNull(restored);
+        Assert.Equal("state-value", restored.State.State);
+        Assert.Null(restored.State.CodeVerifier);
+        Assert.Null(restored.State.RedirectUri);
+        Assert.Null(restored.Username);
+        Assert.Null(restored.AvatarURL);
+        Assert.Null(restored.Folders);
+        Assert.False(restored.Valid);
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    public void Deserialize_WithoutPayload_ReturnsNull(string payload)
+    {
+        Assert.Null(SsoStateSerializer.Deserialize(payload));
+    }
+}
Author	SHA1	Message	Date
benvin	ac1032d85e	Merge pull request 'publish the plugin zip to artifactapi on tag' (#4 ) from benvin/release-pipeline into main ci/woodpecker/tag/release Pipeline was successful Details Reviewed-on: #4	2026-09-19 23:52:47 +10:00
unkin-agent	b5245fe666	Merge remote-tracking branch 'origin/main' into benvin/release-pipeline ci/woodpecker/pr/ci Pipeline was successful Details	2026-09-19 23:45:15 +10:00
unkin-agent	82e4c338ee	publish the plugin zip to artifactapi on tag Add .woodpecker/release.yaml building the JPRM zip and uploading it to the jellyfin-plugins repo, and teach the bump targets the plugin's 4-part version.	2026-09-19 23:43:50 +10:00
benvin	040cffe967	Merge pull request 'Back the SSO OAuth state with the shared cache' (#3 ) from benvin/valkey-oauth-state into main Reviewed-on: #3	2026-09-19 23:38:48 +10:00
benvin	8116ef6930	Merge pull request 'Target the Jellyfin 12.0 plugin ABI' (#2 ) from benvin/jellyfin-12-abi into main Reviewed-on: #2	2026-09-19 23:37:18 +10:00
unkin-agent	e9bc573e7d	snapshot the state store atomically before evicting ci/woodpecker/pr/ci Pipeline was successful Details LINQ buffering of a ConcurrentDictionary is not atomic, so a concurrent write made Evict() throw and fail the login.	2026-09-19 23:23:26 +10:00
unkin-agent	e71df7aa36	bound the in-memory state store and guard store failures ci/woodpecker/pr/ci Pipeline was successful Details Drop a rejected state instead of refreshing its TTL, and turn a store outage into the plugin's error page rather than an unhandled 500.	2026-09-19 23:05:16 +10:00
unkin-agent	5d446c16f2	keep solution file line endings ci/woodpecker/pr/ci Pipeline was successful Details	2026-09-19 22:49:18 +10:00
unkin-agent	a167d00b73	store OAuth state in the shared cache ci/woodpecker/pr/ci Pipeline was successful Details Keys each in-flight OpenID flow in the server's Valkey/Redis connection so a login can start on one replica and finish on another. Falls back to an in-memory store when no multiplexer is registered.	2026-09-19 22:47:43 +10:00
unkin-agent	404be19c2b	target the Jellyfin 12.0 plugin ABI ci/woodpecker/pr/ci Pipeline was successful Details Move the plugin to net10.0 against Jellyfin.Controller/Model 12.0.0 and declare targetAbi 12.0.0.0. Drop the dead Lib F# project and the System.Security.Cryptography.Xml reference, now provided by the net10.0 shared framework.	2026-09-19 22:34:04 +10:00
benvin	f7d909c77a	Merge pull request 'Add Woodpecker CI and Makefile' (#1 ) from benvin/ci into main Reviewed-on: #1	2026-09-19 22:23:10 +10:00
unkin-agent	3dd5110c46	run CI on pull requests only ci/woodpecker/pr/ci Pipeline was successful Details	2026-09-19 22:20:14 +10:00
unkin-agent	7028cfe11d	add woodpecker CI and Makefile ci/woodpecker/push/ci Pipeline was successful Details Build and test the plugin on every push and pull request, and give local builds the same commands plus the house version-bump targets.	2026-09-19 17:48:09 +10:00
Ersei Saggi	f1e157bac2	I'm tired of this grandpa	2026-05-11 21:52:38 -07:00
Ersei Saggi	83deeb253c	Validate SAML responses	2026-03-19 20:11:02 -07:00
Ersei Saggi	ca187a7b5e	Make prettier happy	2026-02-22 11:04:40 -08:00
9p4	05213dc1ee	Merge pull request #349 from mandos21/main Bugfix: Prevent KeyNotFoundExceptions in OidPost	2026-02-11 20:11:01 -08:00
9p4	f7a0c94452	Merge pull request #318 from ForsakenRei/ForsakenRei-patch-1 Update README dead link, add warning for permission overwritten	2026-02-11 07:51:22 -08:00
mandos21	475048a32e	Fixed KeyNotFoundExceptions in PostOid flow	2026-02-02 21:20:49 -05:00
Matt DeGenaro	781e07b2ce	Update role mapping information in configPage.html Clarified default role mapping for Keycloak and Authelia.	2026-02-02 20:27:15 -05:00
9p4	fed7e764a8	Merge pull request #347 from Joker9944/kanidm-config-example Add kanidm config steps	2026-02-01 10:29:53 -08:00
Joker9944	f0def6fd8d	Add kanidm config steps	2026-02-01 10:12:00 +01:00
9p4	8e128932c4	Merge pull request #343 from jon4hz/fix-invalidate-session-immediately fix: invalidate state immediately after auth	2026-01-14 11:39:57 -08:00
jon4hz	5b3d70d328	fix: invalidate state immediately after auth	2026-01-14 20:36:04 +01:00
Ersei Saggi	be26670e1f	Make prettier happy	2026-01-12 17:48:12 -05:00
Ersei Saggi	547eabf55f	Invalidate tokens after authentication In certain cases, users who had their access revoked could log back in.	2026-01-12 17:46:02 -05:00
Ersei Saggi	48d75325b5	Use Jellyfin's HttpClientFactory This should respect proxy settings and set a proper user-agent	2026-01-12 17:35:29 -05:00
Ersei Saggi	cdce0e583d	Add loggerFactory to XML comment Makes CI happy	2025-12-21 02:41:32 -05:00
Ersei Saggi	0e897f922f	Allow not loading profile information from user info endpoint	2025-12-18 15:14:34 -05:00
Ersei Saggi	afbab1073e	Add logging for OIDC library	2025-12-18 15:14:32 -05:00
しぐれ	87425aae36	doc: Add warning for permission overwritten	2025-11-13 21:36:10 -05:00
しぐれ	9be9a1fed8	doc: fix dead OpenID link in README	2025-11-13 21:25:29 -05:00
9p4	3b47851131	Merge pull request #312 from mhlas7/main Add Pocket ID config steps	2025-11-13 09:37:31 -05:00
mhlas7	337ea0ba04	Add Pocket ID to the readme	2025-10-26 14:24:54 -07:00
mhlas7	c37e3e3a71	Add Pocket ID config steps	2025-10-26 12:45:21 -07:00
Ersei Saggi	8f86ce5101	Prepare for 4.0.0.3	2025-10-21 10:37:39 -04:00
Ersei Saggi	d2c77db404	Ensure that disablePushedAuthorization is set to true for authelia	2025-10-21 00:48:35 -04:00
Ersei Saggi	fc3976dcc8	Update download artifact too	2025-10-20 22:48:00 -04:00
Ersei Saggi	fc58b8e80f	Update upload action	2025-10-20 22:43:33 -04:00
Ersei Saggi	da21ebffa3	Specify that pushed authorization may need to be disabled for Authelia	2025-10-20 12:40:02 -04:00
Ersei Saggi	0d18ebae03	Update config UI links https://github.com/9p4/jellyfin-plugin-sso/issues/285	2025-10-20 12:30:55 -04:00
Ersei Saggi	77e2a229f2	Don't use rc libs for Jellyfin 10.11	2025-10-20 12:30:15 -04:00
Ersei Saggi	71bb9a2f14	Jellyfin 10.11.0-rc5	2025-08-14 12:43:04 -04:00
Ersei Saggi	8baa922eea	Manifest should be for 4.0.0.0 / JF10.11	2025-08-12 14:57:22 -04:00
Ersei Saggi	0738ad85f7	Fix warnings	2025-08-12 14:22:31 -04:00
Ersei Saggi	8d049705c4	Update workflows to use dotnet9	2025-08-12 13:51:13 -04:00
Ersei Saggi	3459baffdf	More Jellyfin 10.11 fixes	2025-08-12 13:49:09 -04:00
9p4	de6cd5d5c2	Merge pull request #265 from babbitt/punycode Use punycode URL for redirect page - OIDC	2025-08-11 14:13:48 -04:00
9p4	299d3436ec	Merge pull request #269 from kernelb00t/patch-1 Match the styling of the redirection page with Jellyfin colors and font	2025-08-11 14:12:38 -04:00
9p4	5808f34064	Merge pull request #280 from hendrik1120/patch-1 remove deprecated redirect uri from readme	2025-08-11 14:12:22 -04:00
Ersei Saggi	5ed4c8bbcc	Update to net9.0 for JF 10.11	2025-08-11 14:11:52 -04:00
Hendrik Sievers	f78a0f3108	remove deprecated redirect uri	2025-07-18 11:04:29 +02:00
Leo THIVILLON	aa0e361265	Match the styling of the redirection page with Jellyfin colors and font - Added a style tag - Set color to Jellyfin's dark background and light text - Set font to Noto Sans	2025-05-09 23:26:51 +02:00
Ersei Saggi	efc997c39e	Add security policy Closes #266	2025-05-06 13:46:32 -04:00
Joe Babbitt	caab66b653	use punycode URL for redirect page Redirect page content gets encoded as LATIN1, non LATIN characters in URLs get malformed.	2025-04-29 17:22:38 -04:00
9p4	79ac628c4c	Merge pull request #251 from FeikoJoosten/main Prevent force updating username	2025-04-07 02:30:43 -04:00
Ersei Saggi	fe3ca6337d	We support >=10.8	2025-04-07 02:16:48 -04:00
Feiko Joosten	f761dea356	Removed trailing whitespace	2025-04-05 18:59:36 +02:00
Feiko Joosten	55f58ecedd	Prevent force updating username Fixed an issue where you cannot modify the username as the code tried to find users by name instead of its id.	2025-04-04 01:58:01 +02:00
Ersei Saggi	556feba864	Update credits in README to point to Duende library	2025-03-26 13:55:40 -04:00
Ersei Saggi	1f08ccd213	Prepare for 3.5.3.0	2025-03-26 13:51:26 -04:00
Ersei Saggi	f1f57723c3	Make prettier happy again	2025-03-26 13:14:36 -04:00
Borja Domínguez	216908acd5	Fix artifact names	2025-03-26 16:40:18 +01:00
9p4	9365ca2a33	Merge pull request #246 from bdovaz/allow-port-override Allow port override	2025-03-26 11:34:08 -04:00
Borja Domínguez	ae0ee62f21	Merge branch 'main' into allow-port-override	2025-03-26 16:32:12 +01:00
Ersei Saggi	728a994728	Make prettier happy	2025-03-26 11:20:29 -04:00
9p4	9c0597a5bc	Merge pull request #202 from Estyms/main Avatar via OIDC Provider	2025-03-26 11:18:24 -04:00
9p4	fb9335d908	Merge pull request #247 from bdovaz/fix-nightly-build Update oddstr13/jellyfin-plugin-repository-manager	2025-03-26 11:15:43 -04:00
9p4	cbbafc976b	Merge pull request #244 from bdovaz/replace-oidc-dependency Allow to disable pushed authorization	2025-03-26 11:11:31 -04:00
Borja Domínguez Vázquez	f7bde6f1a0	Change to commit hash	2025-03-24 21:46:49 +01:00
Borja Domínguez Vázquez	d7351ef596	Change EOL	2025-03-24 21:44:34 +01:00
Borja Domínguez Vázquez	07315a124c	Change EOL	2025-03-24 21:43:44 +01:00
Borja Domínguez Vázquez	9e96bd5218	Update oddstr13/jellyfin-plugin-repository-manager	2025-03-24 20:26:18 +01:00
Borja Domínguez Vázquez	6f77735248	Allow to disable pushed authorization	2025-03-24 20:12:48 +01:00
Borja Domínguez Vázquez	73b6c17518	Allow port override	2025-03-24 20:06:28 +01:00
Borja Domínguez Vázquez	86dcd4c579	Better error handling	2025-03-24 20:04:44 +01:00
Borja Domínguez Vázquez	553c88873e	Replace deprecated oidc dependency	2025-03-23 15:00:26 +01:00
9p4	cc86549c2e	Merge pull request #239 from andreblanke/main Support DisableHttps/DoNotValidateIssuerName in SSOController.OidChallenge	2025-03-16 23:10:35 -04:00
Andre Blanke	a2064c1f17	Support DisableHttps/DoNotValidateIssuerName in OidChallenge	2025-03-03 16:54:28 +01:00
Evann Regnault	2cf4230bd6	Merge branch 'main' into main	2025-02-28 04:28:39 +01:00
Ersei Saggi	91c57b18f5	Allow for Fsharp code to be included	2024-11-05 15:17:02 -05:00
Evann Regnault	feb56ebdd6	[AvatarUrlFormat] Better Handling - Mimetype is now inferred by the Response header. - Extension is now derived from the Mimetype	2024-08-04 13:41:37 +02:00
Evann Regnault	2d6e2fc938	Text and JSON fields can now be emptied in configuration	2024-08-04 03:12:50 +02:00
Evann Regnault	ef085e9fa3	Updated README.md - Avatar Url Format Explanation	2024-08-04 03:12:15 +02:00
Evann Regnault	95d2c36e2c	Added AvatarFormatUrl to programatically set avatar on SSO Connect with OIDC	2024-08-04 03:00:06 +02:00
Ersei Saggi	b8e56cefab	Update infra files	2024-06-04 10:26:15 -04:00
Ersei Saggi	e65f358c79	Update webresponse to use updated JS code	2024-06-04 10:25:58 -04:00
Ersei Saggi	cd35ef45ae	Formatting	2024-06-04 09:56:19 -04:00
9p4	b5068f53a6	Merge pull request #193 from CFenner/patch-1 fix: consistently use OpenID instead of OID on the config page	2024-06-04 09:54:04 -04:00
Christopher Fenner	6f584597f6	consistently use OpenID instead of OID on the config page	2024-06-04 12:03:11 +02:00
Ersei Saggi	42fba8656a	Make CI happy	2024-05-13 09:32:52 -04:00
Ersei Saggi	618bcdbd8a	Update GH workflows to use net8.0	2024-05-13 09:31:05 -04:00
Ersei Saggi	2e8c19d631	Update for Jellyfin 10.9	2024-05-13 09:17:42 -04:00
9p4	19a6b49afa	Merge pull request #190 from tbelway/main Update providers.md to include android app keycloak OIDC redirect URI	2024-05-13 08:31:54 -04:00
tbelway	5b26808f0e	Update providers.md to include android app keycloak redirect URI	2024-05-12 20:24:20 -04:00
9p4	2724d64de8	Merge pull request #170 from hendrik1120/main update authelia example to authelia v4.38	2024-03-14 16:40:11 -04:00
Hendrik Sievers	63ec46db4a	keep authelia example configuration prior to v4.38	2024-03-14 21:29:49 +01:00
Hendrik Sievers	4c891d8ef0	update authelia example to authelia v4.38 fix warnings in authelia fix authelia using client_secret_basic instead of client_secret_post	2024-03-14 20:50:39 +01:00
Jade Lovelace	29189a9af0	Update version in SSO-Auth.csproj	2024-02-22 20:23:49 -05:00
Ersei Saggi	3894048168	Prepare for v3.5.2.3	2024-02-21 17:09:51 -05:00
Ersei Saggi	d51e5069d6	feat: allow for better endpoint validation	2024-02-20 09:11:48 -05:00
Sergii Bogomolov	5149cef625	Remove jellyfin_credentials before loading iframe Due to Safari's aggressive caching updated jellyfin_credentials were not used. They were overwritten with the old credentials instead. This fix removes jellyfin_credentials first, then let's iframe load and create new jellyfin_credentials with no access token. After this we update it and login succeeds.	2024-02-10 13:09:05 -05:00
Ersei Saggi	9be3e8e9c4	Update flake.lock	2024-02-07 10:26:00 -05:00
Ersei Saggi	db203808f2	Prettier README linting	2024-02-04 17:40:43 -05:00
Ersei Saggi	ec82bf7fbc	Update README to use form-based login button	2024-02-04 17:38:11 -05:00
Ersei Saggi	87edc5f90a	Prepare for 3.5.2.2	2024-01-22 16:38:06 -05:00
Ersei Saggi	304170e214	Update flake.lock	2024-01-11 09:57:16 -05:00
Ersei Saggi	9321c25f20	feat: allow linking to work with new paths	2024-01-11 09:56:45 -05:00
Ersei Saggi	ebf7eef83e	docs: mention quick connect in README	2023-12-09 16:15:43 -05:00
Ersei Saggi	065ea8b5cd	docs: mention to have both paths in redirects	2023-11-24 17:59:46 -05:00
Ersei Saggi	0476f817a6	v.3.5.2.1	2023-10-18 01:11:26 -04:00
Ersei Saggi	3bb241b6d2	Clarify docs	2023-10-18 01:11:10 -04:00
Ersei Saggi	cb26ba9852	Add yet another null check in SAML	2023-10-18 01:09:33 -04:00
Ersei Saggi	1b6761bf73	fix: add another null check in SAML for the default provider	2023-09-01 15:59:13 -04:00
Ersei Saggi	eeabc3cc46	Merge branch 'main' of github.com:9p4/jellyfin-plugin-sso	2023-08-29 13:06:15 -04:00
Ersei Saggi	e65c5add95	fix: a few more null checks	2023-08-29 13:06:02 -04:00
Nathan Easton	fce636bddd	Added a section in the authentik provider (#137 ) Add note about error processing request from issue #136	2023-08-22 13:29:50 -04:00
Ersei Saggi	94d1c7a95a	Prepare for 3.5.2.0	2023-08-07 13:15:04 -04:00
Ersei Saggi	a1a355591c	docs: add Nix flakes blurb	2023-08-07 12:26:51 -04:00
Ersei Saggi	71802d954c	docs: fix SAML paths in docs	2023-08-07 12:24:04 -04:00
Ersei Saggi	f37e8dd3bb	fix: handle empty and invalid strings in the schemeOverride	2023-08-07 12:14:52 -04:00
Ersei Saggi	9b667b3175	feat: allow overriding redirect scheme	2023-08-07 12:09:51 -04:00
Ersei Saggi	2c3fc4d8e1	Prepare for 3.5.1.1	2023-08-07 08:42:10 -04:00
Ersei Saggi	f897704100	fix: change iframe URL to point to the web UI instead of the root	2023-08-07 08:23:34 -04:00
Ersei Saggi	d0b9b10a36	fix: remove the commit lint check (it's really useless)	2023-08-06 16:36:24 -04:00
Ersei Saggi	172f22e19f	release: prepare for v3.5.1.0	2023-08-06 16:34:57 -04:00
Ersei Saggi	5777c8038e	fix: improve final redirect (#109 )	2023-08-06 16:29:44 -04:00
Ersei Saggi	95776b427b	style: fix configPage style (prettier)	2023-08-06 16:27:01 -04:00
Ersei Saggi	b82a3867e4	docs: detail Google requiring disabling of OpenID endpoint validation	2023-08-06 16:24:05 -04:00
Ersei Saggi	657f90ef13	fix: make SAML paths better; improve and add OID discovery defaults	2023-08-06 16:19:53 -04:00
Ersei Saggi	dd01e729b8	docs: clarify plugin resetting permissions	2023-08-06 14:47:56 -04:00
Ersei Saggi	f2452103bf	style: fix README.md style	2023-08-06 14:44:23 -04:00
Ersei Saggi	076cb1b893	docs: document how to set login disclaimer (#16 )	2023-08-06 14:43:09 -04:00
Ersei Saggi	defab9c4e8	feat: clarify redirect paths (#84 )	2023-08-06 14:32:05 -04:00
Ersei Saggi	2ead846ed8	fix: Remove funding	2023-08-05 18:58:04 -04:00