Prepare for v3.5.2.3

Due to Safari's aggressive caching updated jellyfin_credentials were not
used. They were overwritten with the old credentials instead. This fix
removes jellyfin_credentials first, then let's iframe load and create
new jellyfin_credentials with no access token. After this we update it
and login succeeds.

README.md

@@ -34,7 +34,7 @@ This is 100% alpha software! PRs are welcome to improve the code.
 
 ~~There is NO admin configuration! You must use the API to configure the program!~~ Added by [strazto](https://github.com/strazto) in PR [#18](https://github.com/9p4/jellyfin-plugin-sso/pull/18) and [#27](https://github.com/9p4/jellyfin-plugin-sso/pull/27).
 
-**[This is for Jellyfin 10.8](https://github.com/9p4/jellyfin-plugin-sso/issues/3) and only on the Web UI!**
+**[This is for Jellyfin 10.8](https://github.com/9p4/jellyfin-plugin-sso/issues/3) and only on the Web UI and clients supporting [Quick Connect](https://jellyfin.org/docs/general/server/quick-connect)**
 
 **This README reflects the branch it is currently on! Switch tags to view version-specific documentation!**
 
@@ -91,16 +91,18 @@ The nightly build may have new features unavailable in other builds, but **be wa
 
 ## Examples
 
+**Note that you should add both "/r/" and "/redirect/" paths to your SSO provider's configuration!**
+
 ### Creating A Login Button On The Main Page
 
 In the Jellyfin administration UI, under "General", there is a "Branding" section. In that section, add the following code in the "Login disclaimer" block (replacing `PROVIDER_NAME` and the domain):
 
 ```html
-<a
-  href="https://jellyfin.example.com/sso/OID/start/PROVIDER_NAME"
-  class="raised cancel block emby-button"
-  >Sign in with SSO</a
->
+<form action="https://jellyfin.example.com/sso/OID/start/PROVIDER_NAME">
+  <button class="raised block emby-button button-submit">
+    Sign in with SSO
+  </button>
+</form>
 ```
 
 Then, add the following code in the "Custom CSS code" section:

SSO-Auth/Api/SSOController.cs

@@ -91,6 +91,8 @@ public class SSOController : ControllerBase
                 RedirectUri = GetRequestBase(config.SchemeOverride) + $"/sso/OID/{(Request.Path.Value.Contains("/start/", StringComparison.InvariantCultureIgnoreCase) ? "redirect" : "r")}/" + provider,
                 Scope = string.Join(" ", scopes.Prepend("openid profile")),
             };
+            var oidEndpointUri = new Uri(config.OidEndpoint?.Trim());
+            options.Policy.Discovery.AdditionalEndpointBaseAddresses.Add(oidEndpointUri.GetLeftPart(UriPartial.Authority));
             options.Policy.Discovery.ValidateEndpoints = !config.DoNotValidateEndpoints; // For Google and other providers with different endpoints
             options.Policy.Discovery.RequireHttps = !config.DisableHttps;
             options.Policy.Discovery.ValidateIssuerName = !config.DoNotValidateIssuerName;
@@ -288,15 +290,26 @@ public class SSOController : ControllerBase
 
         if (config.Enabled)
         {
+            bool newPath = config.NewPath;
+            if (!isLinking)
+            {
+                newPath = Request.Path.Value.Contains("/start/", StringComparison.InvariantCultureIgnoreCase);
+                config.NewPath = newPath;
+            }
+
+            string redirectUri = GetRequestBase(config.SchemeOverride) + $"/sso/OID/{(newPath ? "redirect" : "r")}/" + provider;
+
             var options = new OidcClientOptions
             {
                 Authority = config.OidEndpoint?.Trim(),
                 ClientId = config.OidClientId?.Trim(),
                 ClientSecret = config.OidSecret?.Trim(),
-                RedirectUri = GetRequestBase(config.SchemeOverride) + $"/sso/OID/{(Request.Path.Value.Contains("/start/", StringComparison.InvariantCultureIgnoreCase) ? "redirect" : "r")}/" + provider,
+                RedirectUri = redirectUri,
                 Scope = string.Join(" ", config.OidScopes.Prepend("openid profile")),
             };
-            options.Policy.Discovery.ValidateEndpoints = false; // For Google and other providers with different endpoints
+            var oidEndpointUri = new Uri(config.OidEndpoint?.Trim());
+            options.Policy.Discovery.AdditionalEndpointBaseAddresses.Add(oidEndpointUri.GetLeftPart(UriPartial.Authority));
+            options.Policy.Discovery.ValidateEndpoints = !config.DoNotValidateEndpoints; // For Google and other providers with different endpoints
             var oidcClient = new OidcClient(options);
             var state = await oidcClient.PrepareLoginAsync().ConfigureAwait(false);
             StateManager.Add(state.State, new TimedAuthorizeState(state, DateTime.Now));
@@ -514,6 +527,14 @@ public class SSOController : ControllerBase
 
         if (config.Enabled)
         {
+            bool newPath = config.NewPath;
+            if (!isLinking)
+            {
+                newPath = Request.Path.Value.Contains("/start/", StringComparison.InvariantCultureIgnoreCase);
+                config.NewPath = newPath;
+            }
+
+            string redirectUri = GetRequestBase(config.SchemeOverride) + $"/sso/SAML/{(newPath ? "post" : "p")}/" + provider;
             string relayState = null;
             if (isLinking)
             {
@@ -522,7 +543,7 @@ public class SSOController : ControllerBase
 
             var request = new AuthRequest(
                 config.SamlClientId.Trim(),
-                GetRequestBase(config.SchemeOverride) + $"/sso/SAML/{(Request.Path.Value.Contains("/start/", StringComparison.InvariantCultureIgnoreCase) ? "post" : "p")}/" + provider);
+                redirectUri);
 
             return Redirect(request.GetRedirectUrl(config.SamlEndpoint.Trim(), relayState));
         }

SSO-Auth/Config/PluginConfiguration.cs

@@ -131,6 +131,11 @@ public class SamlConfig
     /// </summary>
     public string SchemeOverride { get; set; }
 
+    /// <summary>
+    /// Gets or sets a value indicating whether the new, more descriptive paths are to be used.
+    /// </summary>
+    public bool NewPath { get; set; }
+
     /// <summary>
     /// Gets or sets a mapping of canonical names from the provider to jellyfin user ids.
     /// </summary>
@@ -260,6 +265,11 @@ public class OidConfig
     /// </summary>
     public string SchemeOverride { get; set; }
 
+    /// <summary>
+    /// Gets or sets a value indicating whether the new, more descriptive paths are to be used.
+    /// </summary>
+    public bool NewPath { get; set; }
+
     /// <summary>
     /// Gets or sets a mapping of canonical names from the provider to jellyfin user ids.
     /// </summary>

SSO-Auth/WebResponse.cs

@@ -453,6 +453,9 @@ async function link(request) {
 }
 
 async function main() {
+    localStorage.removeItem('jellyfin_credentials');
+    document.getElementById('iframe-main').src = '" + baseUrl + @"/web/index.html';
+
     var data = '" + data + @"';
     while (localStorage.getItem(""_deviceId2"") == null ||
         localStorage.getItem(""jellyfin_credentials"") == null ||
@@ -501,6 +504,6 @@ document.addEventListener('DOMContentLoaded', function () {
 });
 
 // https://stackoverflow.com/a/25435165
-</script><iframe class='docs-texteventtarget-iframe' sandbox='allow-same-origin allow-forms allow-scripts' src='" + baseUrl + "/web/index.html' style='position: absolute;width:0;height:0;border:0;'></iframe></body></html>";
+</script><iframe id='iframe-main' class='docs-texteventtarget-iframe' sandbox='allow-same-origin allow-forms allow-scripts' src='' style='position: absolute;width:0;height:0;border:0;'></iframe></body></html>";
     }
 }

build.yaml

@@ -1,7 +1,7 @@
 name: "SSO Authentication"
 guid: "505ce9d1-d916-42fa-86ca-673ef241d7df"
 imageUrl: "https://raw.githubusercontent.com/9p4/jellyfin-plugin-sso/main/img/logo.png"
-version: "3.5.2.1"
+version: "3.5.2.3"
 targetAbi: "10.8.0.0"
 framework: "net6.0"
 owner: "9p4"
@@ -15,6 +15,8 @@ artifacts:
   - "IdentityModel.OidcClient.dll"
   - "IdentityModel.dll"
 changelog: |
+  3.5.2.3: Improve OpenID discovery policy security rules, fix iOS login bugs related to cache
+  3.5.2.2: Fix linking page when using new paths
   3.5.2.1: Hotfix for SAML null checks
   3.5.2.0: Allow overriding the scheme used for generating URLs.
   3.5.1.1: Change iframe URL to point to the web UI instead of the root 

flake.lock

@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1691218994,
-        "narHash": "sha256-46GJ5vLf9H+Oh7Jii2gJI9GATJHGbx2iQpon5nUSFPI=",
+        "lastModified": 1707205916,
+        "narHash": "sha256-fmRJilYGlB7VCt3XsdYxrA0u8e/K84O5xYucerUY0iM=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "0d2fb29f5071a12d7983319c2c2576be6a130582",
+        "rev": "8cc79aa39bbc6eaedaf286ae655b224c71e02907",
         "type": "github"
       },
       "original": {