# LDAP provider + outpost for Jellyfin native-client app-password validation.
#
# Jellyfin's web UI signs in via OIDC (see providers_oauth2/jellyfin.yaml), but
# native clients (mobile/TV apps, DLNA) cannot do a browser OIDC dance. Those
# clients authenticate against this Authentik LDAP outpost using their username
# plus an Authentik "App password" token as the bind password. The Jellyfin LDAP
# plugin binds as the user; a successful bind == valid app-password.
#
# bind_mode "direct": the outpost runs the bind_flow (default-authentication-flow)
# on every bind request, so app-password revocation takes effect immediately.
# search_mode "direct": entries are read live from the Authentik API. Search is
# gated by Authentik's directory permissions -- the bound user is NOT granted the
# "Search full LDAP directory" permission, so it can only read its own entry,
# which is all the Jellyfin plugin needs to resolve the user after bind.
#
# base_dn is the Authentik default LDAP tree. The module creates the matching
# authentik_application (slug jellyfin-ldap) and authentik_outpost
# (name jellyfin-ldap-outpost, type ldap). The outpost's API token is generated
# by Authentik AFTER apply and must be seeded into KV for the k8s outpost
# Deployment to consume: kv/kubernetes/namespace/authentik/default/outpost-token (key: token).
name: Jellyfin LDAP
bind_flow: default-authentication-flow
unbind_flow: default-invalidation-flow
base_dn: DC=ldap,DC=goauthentik,DC=io
bind_mode: direct
search_mode: direct
mfa_support: true