unkin-agent
bbbb61777c
Jellyfin moves to Authentik SSO via jellyfin-plugin-sso (OIDC), keeping native clients on Jellyfin local/API auth. Adds the oauth2 provider and application for jellyfin.k8s.syd1.au.unkin.net plus the akP permission groups gating access, wired into the standard-user and global-admin roles per the two-tier RBAC model. - Adds providers_oauth2/jellyfin.yaml: confidential client, secret read from kv/kubernetes/namespace/jellyfin/default/oauth-credentials, redirect URIs for the SSO plugin callback paths - Adds akP-jellyfin-admin and akP-jellyfin-user bound to the app - Nests akP-jellyfin-user under akR-standard-user and akP-jellyfin-admin under akR-global-admin
4 lines
175 B
YAML
4 lines
175 B
YAML
# Permission group akP-jellyfin-user (name = filename). Grants user
|
|
# access to jellyfin: bound to the jellyfin application and mapped to its user role.
|
|
application: jellyfin
|