Add Jellyfin OIDC provider, application and RBAC groups #19

2026-08-23T12:34:15+10:00

unkin-agent commented

2026-08-23 12:34:15 +10:00

Why

Jellyfin (task #3, auth) moves to Authentik SSO via jellyfin-plugin-sso (OIDC) so the web UI signs in through Authentik while native Jellyfin clients keep local/API auth. This is PR 1 of the multi-PR onboarding: the Authentik side only, following the existing provider-yaml pattern (client secret from Vault, no terraform-vault changes).

Changes

Adds config/providers_oauth2/jellyfin.yaml: confidential OIDC client jellyfin for jellyfin.k8s.syd1.au.unkin.net; client_secret read from kv/kubernetes/namespace/jellyfin/default/oauth-credentials; strict redirect URIs for both jellyfin-plugin-sso callback paths (/sso/OID/redirect/authentik and legacy /sso/OID/r/authentik); no role_mappings claim — the plugin requests the ak_groups scope and matches the hierarchical groups claim directly
Adds permission groups akP-jellyfin-admin / akP-jellyfin-user bound to the jellyfin application (access gating per the two-tier RBAC model)
Nests akP-jellyfin-user under akR-standard-user and akP-jellyfin-admin under akR-global-admin

Note for reviewer

The CI plan reads the Vault kv secret at plan time, so it stays red until kv/kubernetes/namespace/jellyfin/default/oauth-credentials is seeded with a client_secret key (agent Vault access was blocked this session; seed command posted in the task summary).

## Why Jellyfin (task #3, auth) moves to Authentik SSO via jellyfin-plugin-sso (OIDC) so the web UI signs in through Authentik while native Jellyfin clients keep local/API auth. This is PR 1 of the multi-PR onboarding: the Authentik side only, following the existing provider-yaml pattern (client secret from Vault, no terraform-vault changes). ## Changes - Adds `config/providers_oauth2/jellyfin.yaml`: confidential OIDC client `jellyfin` for jellyfin.k8s.syd1.au.unkin.net; client_secret read from `kv/kubernetes/namespace/jellyfin/default/oauth-credentials`; strict redirect URIs for both jellyfin-plugin-sso callback paths (`/sso/OID/redirect/authentik` and legacy `/sso/OID/r/authentik`); no role_mappings claim — the plugin requests the `ak_groups` scope and matches the hierarchical groups claim directly - Adds permission groups `akP-jellyfin-admin` / `akP-jellyfin-user` bound to the jellyfin application (access gating per the two-tier RBAC model) - Nests `akP-jellyfin-user` under `akR-standard-user` and `akP-jellyfin-admin` under `akR-global-admin` ## Note for reviewer The CI plan reads the Vault kv secret at plan time, so it stays red until `kv/kubernetes/namespace/jellyfin/default/oauth-credentials` is seeded with a `client_secret` key (agent Vault access was blocked this session; seed command posted in the task summary).

unkin-agent added 1 commit 2026-08-23 12:34:15 +10:00

Add Jellyfin OIDC provider, application and RBAC groups

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/plan Pipeline was successful

Details

bbbb61777c

Jellyfin moves to Authentik SSO via jellyfin-plugin-sso (OIDC), keeping
native clients on Jellyfin local/API auth. Adds the oauth2 provider and
application for jellyfin.k8s.syd1.au.unkin.net plus the akP permission
groups gating access, wired into the standard-user and global-admin
roles per the two-tier RBAC model.

- Adds providers_oauth2/jellyfin.yaml: confidential client, secret read
  from kv/kubernetes/namespace/jellyfin/default/oauth-credentials,
  redirect URIs for the SSO plugin callback paths
- Adds akP-jellyfin-admin and akP-jellyfin-user bound to the app
- Nests akP-jellyfin-user under akR-standard-user and
  akP-jellyfin-admin under akR-global-admin

benvin merged commit 5c136dfb96 into main

2026-08-23 22:10:35 +10:00

benvin deleted branch benvin/jellyfin-oidc

2026-08-23 22:10:36 +10:00

unkinben referenced this issue from a commit

2026-08-23 22:41:13 +10:00

Merge origin/main (jellyfin #19) into benvin/logviewer-oidc

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-authentik#19