unkin-agent
9760c2eb3f
Reference the actual Vault KV seed path for outpost token instead of deferring to PR body.
28 lines
1.5 KiB
YAML
28 lines
1.5 KiB
YAML
# LDAP provider + outpost for Jellyfin native-client app-password validation.
|
|
#
|
|
# Jellyfin's web UI signs in via OIDC (see providers_oauth2/jellyfin.yaml), but
|
|
# native clients (mobile/TV apps, DLNA) cannot do a browser OIDC dance. Those
|
|
# clients authenticate against this Authentik LDAP outpost using their username
|
|
# plus an Authentik "App password" token as the bind password. The Jellyfin LDAP
|
|
# plugin binds as the user; a successful bind == valid app-password.
|
|
#
|
|
# bind_mode "direct": the outpost runs the bind_flow (default-authentication-flow)
|
|
# on every bind request, so app-password revocation takes effect immediately.
|
|
# search_mode "direct": entries are read live from the Authentik API. Search is
|
|
# gated by Authentik's directory permissions -- the bound user is NOT granted the
|
|
# "Search full LDAP directory" permission, so it can only read its own entry,
|
|
# which is all the Jellyfin plugin needs to resolve the user after bind.
|
|
#
|
|
# base_dn is the Authentik default LDAP tree. The module creates the matching
|
|
# authentik_application (slug jellyfin-ldap) and authentik_outpost
|
|
# (name jellyfin-ldap-outpost, type ldap). The outpost's API token is generated
|
|
# by Authentik AFTER apply and must be seeded into KV for the k8s outpost
|
|
# Deployment to consume: kv/kubernetes/namespace/authentik/default/outpost-token (key: token).
|
|
name: Jellyfin LDAP
|
|
bind_flow: default-authentication-flow
|
|
unbind_flow: default-invalidation-flow
|
|
base_dn: DC=ldap,DC=goauthentik,DC=io
|
|
bind_mode: direct
|
|
search_mode: direct
|
|
mfa_support: true
|