unkin-agent
3396b399ce
Completes the Authentik-side plumbing for Jellyfin SSO across both media instances -- fafflix (adults, jellyfin.k8s.syd1.au.unkin.net) and cheeztv (kids, cheeztv.unkin.net + cheeztv.k8s.syd1.au.unkin.net) -- and adds an LDAP outpost so native clients can authenticate with app passwords. Why: the previously-merged jellyfin OIDC provider only covered the fafflix host and gated on the generic jellyfin permission groups. cheeztv needs SSO too, access should be limited to media users, and native (non-browser) clients need a password-based path. How: - providers_oauth2/jellyfin.yaml: one shared confidential client now lists strict redirect URIs for all three hosts using the verified jellyfin-plugin-sso callback path /sso/OID/redirect/authentik. Client secret moved to kv kubernetes/namespace/fafflix/default/oauth-credentials. - Access is gated to media users only: akP-media-fafflix and akP-media-cheeztv now carry `application: jellyfin` and bind to the app; akP-jellyfin-admin / akP-jellyfin-user are demoted to pure role-claim groups (no app binding), still mapped by the plugin for admin/user rights. Per-instance authz (adults -> both, kids -> cheeztv only) stays with the media proxy. - providers_ldap/jellyfin-ldap.yaml: new LDAP provider (base_dn DC=ldap,DC=goauthentik,DC=io, direct bind/search) + application (jellyfin-ldap) + outpost (jellyfin-ldap-outpost) via the existing module. - modules/authentik/main.tf: resolve LDAP bind/unbind flow slugs to ids via data.authentik_flow, matching the oauth2/saml convention.
28 lines
1.5 KiB
YAML
28 lines
1.5 KiB
YAML
# LDAP provider + outpost for Jellyfin native-client app-password validation.
|
|
#
|
|
# Jellyfin's web UI signs in via OIDC (see providers_oauth2/jellyfin.yaml), but
|
|
# native clients (mobile/TV apps, DLNA) cannot do a browser OIDC dance. Those
|
|
# clients authenticate against this Authentik LDAP outpost using their username
|
|
# plus an Authentik "App password" token as the bind password. The Jellyfin LDAP
|
|
# plugin binds as the user; a successful bind == valid app-password.
|
|
#
|
|
# bind_mode "direct": the outpost runs the bind_flow (default-authentication-flow)
|
|
# on every bind request, so app-password revocation takes effect immediately.
|
|
# search_mode "direct": entries are read live from the Authentik API. Search is
|
|
# gated by Authentik's directory permissions -- the bound user is NOT granted the
|
|
# "Search full LDAP directory" permission, so it can only read its own entry,
|
|
# which is all the Jellyfin plugin needs to resolve the user after bind.
|
|
#
|
|
# base_dn is the Authentik default LDAP tree. The module creates the matching
|
|
# authentik_application (slug jellyfin-ldap) and authentik_outpost
|
|
# (name jellyfin-ldap-outpost, type ldap). The outpost's API token is generated
|
|
# by Authentik AFTER apply and must be seeded into KV for the k8s outpost
|
|
# Deployment to consume (see PR body for the exact path).
|
|
name: Jellyfin LDAP
|
|
bind_flow: default-authentication-flow
|
|
unbind_flow: default-invalidation-flow
|
|
base_dn: DC=ldap,DC=goauthentik,DC=io
|
|
bind_mode: direct
|
|
search_mode: direct
|
|
mfa_support: true
|