Coder Social home page Coder Social logo

Comments (12)

9p4 avatar 9p4 commented on August 28, 2024

If you are using the old /p/ paths, then the plugin will use the /r/ paths for the redirect. Instead, try going to /start/ instead of /p/.

from jellyfin-plugin-sso.

9p4 avatar 9p4 commented on August 28, 2024

futhermore, OIDScopes should be just a space separated list, not JSON-formatted.

from jellyfin-plugin-sso.

duncan-valleix avatar duncan-valleix commented on August 28, 2024

If you are using the old /p/ paths, then the plugin will use the /r/ paths for the redirect. Instead, try going to /start/ instead of /p/

as mentioned above, I've tried all 4 and the result is the same in the end.

futhermore, OIDScopes should be just a space separated list, not JSON-formatted.

I will take note of this and modify it. thank you.

from jellyfin-plugin-sso.

duncan-valleix avatar duncan-valleix commented on August 28, 2024

in authelia it is currently declared as follows,

      - id: jellyfin
        description: Jellyfin
        # Client secret should be randomly generated
        secret: '$pbkdf2-sha512$REDACTED'
        authorization_policy: one_factor
        redirect_uris:
          - https://jellyfin.ndd.com/sso/OID/redirect/authelia

in jellyfin like this

<OidEndpoint>https://auth.ndd.com</OidEndpoint>

so if I call https://jellyfin.ndd.com/sso/OID/start/authelia I should have received a favourable reply, but instead I got this one {"error":"invalid_request","error_description":"The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. The 'redirect_uri' parameter does not match any of the OAuth 2.0 Client's pre-registered redirect urls."}

from jellyfin-plugin-sso.

9p4 avatar 9p4 commented on August 28, 2024

Can you upload the whole Jellyfin log? I need to see what happens when you go to /start/authelia

from jellyfin-plugin-sso.

duncan-valleix avatar duncan-valleix commented on August 28, 2024

Can you upload the whole Jellyfin log? I need to see what happens when you go to /start/authelia

when I make a call from /start/authelia I have this in the jellyfin log

[18:11:58] [INF] [23] Jellyfin.Plugin.SSO_Auth.Api.SSOController: SSO Controller initialized

and I have this in authelia's log

time="2023-08-20T18:14:34+02:00" level=debug msg="Notifier SMTP client attempting connection to smtp.gmail.com:465"
time="2023-08-20T18:14:34+02:00" level=debug msg="Notifier SMTP client using submissions port 465. Make sure the mail server you are connecting to is configured for submissions and not SMTPS."
time="2023-08-20T18:14:34+02:00" level=debug msg="Notifier SMTP client connected successfully"
time="2023-08-20T18:14:34+02:00" level=debug msg="Notifier SMTP connection is already encrypted, skipping STARTTLS"
time="2023-08-20T18:14:34+02:00" level=debug msg="Notifier SMTP server supports authentication with the following mechanisms: LOGIN PLAIN XOAUTH2 PLAIN-CLIENTTOKEN OAUTHBEARER XOAUTH"
time="2023-08-20T18:14:34+02:00" level=debug msg="Notifier SMTP client attempting AUTH PLAIN with server"
time="2023-08-20T18:14:34+02:00" level=debug msg="Notifier SMTP client authenticated successfully with the server"
time="2023-08-20T18:14:34+02:00" level=info msg="Initializing server for non-TLS connections on '[::]:9091' path '/'"
time="2023-08-20T18:14:51+02:00" level=error msg="Authorization Request failed with error: The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. The 'redirect_uri' parameter does not match any of the OAuth 2.0 Client's pre-registered redirect urls." method=GET path=/api/oidc/authorization remote_ip=10.0.20.50 stack="github.com/authelia/authelia/v4/internal/handlers/handler_oidc_authorization.go:32           OpenIDConnectAuthorization\ngithub.com/authelia/authelia/v4/internal/middlewares/http_to_authelia_handler_adaptor.go:113 NewHTTPToAutheliaHandlerAdaptor.func1\ngithub.com/authelia/authelia/v4/internal/middlewares/bridge.go:54                            (*BridgeBuilder).Build.func1.1\ngithub.com/authelia/authelia/v4/internal/middlewares/headers.go:35                           SecurityHeadersNoStore.func1\ngithub.com/authelia/authelia/v4/internal/middlewares/headers.go:25                           SecurityHeadersCSPNone.func1\ngithub.com/authelia/authelia/v4/internal/middlewares/headers.go:16                           SecurityHeaders.func1\ngithub.com/authelia/authelia/v4/internal/middlewares/cors.go:216                             (*CORSPolicy).Middleware.func1\ngithub.com/fasthttp/[email protected]/router.go:414                                             (*Router).Handler\ngithub.com/valyala/[email protected]/http.go:154                                              (*Response).StatusCode\ngithub.com/valyala/[email protected]/server.go:2338                                           (*Server).serveConn\ngithub.com/valyala/[email protected]/workerpool.go:224                                        (*workerPool).workerFunc\ngithub.com/valyala/[email protected]/workerpool.go:196                                        (*workerPool).getCh.func1\nruntime/asm_amd64.s:1594                                                                     goexit"

from jellyfin-plugin-sso.

9p4 avatar 9p4 commented on August 28, 2024

Can you force the redirect scheme to be "https"? This should be the "scheme override" option in the settings.

from jellyfin-plugin-sso.

duncan-valleix avatar duncan-valleix commented on August 28, 2024

Can you force the redirect scheme to be "https"? This should be the "scheme override" option in the settings.

it works, so I guess that was the problem. many thanks

from jellyfin-plugin-sso.

9p4 avatar 9p4 commented on August 28, 2024

It seems like your reverse proxy is misconfigured and not sending Jellyfin the right headers that lets it know that it is running over HTTPS. Jellyfin was then using "http" instead of "https" to generate the redirect url, which caused the issue.

See also: #129 and many more.

from jellyfin-plugin-sso.

duncan-valleix avatar duncan-valleix commented on August 28, 2024

It seems like your reverse proxy is misconfigured and not sending Jellyfin the right headers that lets it know that it is running over HTTPS. Jellyfin was then using "http" instead of "https" to generate the redirect url, which caused the issue.

See also: #129 and many more.

this is very likely because between my reverse proxy (traefik) and jellyfin, it communicates via the network with the container_name.http://jellyfin:8096

well now I have a permission problem, do I have to look elsewhere or can you help me?

in the jellyfin log I have this

[18:35:38] [INF] [22] Jellyfin.Plugin.SSO_Auth.Api.SSOController: SSO Controller initialized
[18:35:41] [INF] [22] Jellyfin.Plugin.SSO_Auth.Api.SSOController: SSO Controller initialized
[18:35:42] [WRN] [20] Jellyfin.Plugin.SSO_Auth.Api.SSOController: OpenID user f6141dcb-3d4e has one or more incorrect role claims: [{"Type": "amr", "Value": "pwd"}, {"Type": "azp", "Value": "jellyfin"}, {"Type": "client_id", "Value": "jellyfin"}, {"Type": "jti", "Value": "4a6dadce-2c66-4f1e-b830-a4dd54e3e975"}, {"Type": "name", "Value": "Prenom NOM"}, {"Type": "preferred_username", "Value": "prenom-nom"}, {"Type": "rat", "Value": "1692549338"}, {"Type": "sub", "Value": "f6141dcb-3d4e-"}]. Expected any one of: ["seedbox_users"]

from jellyfin-plugin-sso.

9p4 avatar 9p4 commented on August 28, 2024

You can create a discussion post for the permission error. I can tell you that it looks like authelia is not sending over any group/role information. I'm not very good with authelia, so I won't be of much help with that side of things.

from jellyfin-plugin-sso.

duncan-valleix avatar duncan-valleix commented on August 28, 2024

You can create a discussion post for the permission error. I can tell you that it looks like authelia is not sending over any group/role information. I'm not very good with authelia, so I won't be of much help with that side of things.

I'll have a look at this, thank you very much. :D

from jellyfin-plugin-sso.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.