Comments (12)
If you are using the old /p/
paths, then the plugin will use the /r/
paths for the redirect. Instead, try going to /start/
instead of /p/
.
from jellyfin-plugin-sso.
futhermore, OIDScopes should be just a space separated list, not JSON-formatted.
from jellyfin-plugin-sso.
If you are using the old /p/ paths, then the plugin will use the /r/ paths for the redirect. Instead, try going to /start/ instead of /p/
as mentioned above, I've tried all 4 and the result is the same in the end.
futhermore, OIDScopes should be just a space separated list, not JSON-formatted.
I will take note of this and modify it. thank you.
from jellyfin-plugin-sso.
in authelia it is currently declared as follows,
- id: jellyfin
description: Jellyfin
# Client secret should be randomly generated
secret: '$pbkdf2-sha512$REDACTED'
authorization_policy: one_factor
redirect_uris:
- https://jellyfin.ndd.com/sso/OID/redirect/authelia
in jellyfin like this
<OidEndpoint>https://auth.ndd.com</OidEndpoint>
so if I call https://jellyfin.ndd.com/sso/OID/start/authelia
I should have received a favourable reply, but instead I got this one {"error":"invalid_request","error_description":"The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. The 'redirect_uri' parameter does not match any of the OAuth 2.0 Client's pre-registered redirect urls."}
from jellyfin-plugin-sso.
Can you upload the whole Jellyfin log? I need to see what happens when you go to /start/authelia
from jellyfin-plugin-sso.
Can you upload the whole Jellyfin log? I need to see what happens when you go to
/start/authelia
when I make a call from /start/authelia
I have this in the jellyfin log
[18:11:58] [INF] [23] Jellyfin.Plugin.SSO_Auth.Api.SSOController: SSO Controller initialized
and I have this in authelia's log
time="2023-08-20T18:14:34+02:00" level=debug msg="Notifier SMTP client attempting connection to smtp.gmail.com:465"
time="2023-08-20T18:14:34+02:00" level=debug msg="Notifier SMTP client using submissions port 465. Make sure the mail server you are connecting to is configured for submissions and not SMTPS."
time="2023-08-20T18:14:34+02:00" level=debug msg="Notifier SMTP client connected successfully"
time="2023-08-20T18:14:34+02:00" level=debug msg="Notifier SMTP connection is already encrypted, skipping STARTTLS"
time="2023-08-20T18:14:34+02:00" level=debug msg="Notifier SMTP server supports authentication with the following mechanisms: LOGIN PLAIN XOAUTH2 PLAIN-CLIENTTOKEN OAUTHBEARER XOAUTH"
time="2023-08-20T18:14:34+02:00" level=debug msg="Notifier SMTP client attempting AUTH PLAIN with server"
time="2023-08-20T18:14:34+02:00" level=debug msg="Notifier SMTP client authenticated successfully with the server"
time="2023-08-20T18:14:34+02:00" level=info msg="Initializing server for non-TLS connections on '[::]:9091' path '/'"
time="2023-08-20T18:14:51+02:00" level=error msg="Authorization Request failed with error: The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. The 'redirect_uri' parameter does not match any of the OAuth 2.0 Client's pre-registered redirect urls." method=GET path=/api/oidc/authorization remote_ip=10.0.20.50 stack="github.com/authelia/authelia/v4/internal/handlers/handler_oidc_authorization.go:32 OpenIDConnectAuthorization\ngithub.com/authelia/authelia/v4/internal/middlewares/http_to_authelia_handler_adaptor.go:113 NewHTTPToAutheliaHandlerAdaptor.func1\ngithub.com/authelia/authelia/v4/internal/middlewares/bridge.go:54 (*BridgeBuilder).Build.func1.1\ngithub.com/authelia/authelia/v4/internal/middlewares/headers.go:35 SecurityHeadersNoStore.func1\ngithub.com/authelia/authelia/v4/internal/middlewares/headers.go:25 SecurityHeadersCSPNone.func1\ngithub.com/authelia/authelia/v4/internal/middlewares/headers.go:16 SecurityHeaders.func1\ngithub.com/authelia/authelia/v4/internal/middlewares/cors.go:216 (*CORSPolicy).Middleware.func1\ngithub.com/fasthttp/[email protected]/router.go:414 (*Router).Handler\ngithub.com/valyala/[email protected]/http.go:154 (*Response).StatusCode\ngithub.com/valyala/[email protected]/server.go:2338 (*Server).serveConn\ngithub.com/valyala/[email protected]/workerpool.go:224 (*workerPool).workerFunc\ngithub.com/valyala/[email protected]/workerpool.go:196 (*workerPool).getCh.func1\nruntime/asm_amd64.s:1594 goexit"
from jellyfin-plugin-sso.
Can you force the redirect scheme to be "https"? This should be the "scheme override" option in the settings.
from jellyfin-plugin-sso.
Can you force the redirect scheme to be "https"? This should be the "scheme override" option in the settings.
it works, so I guess that was the problem. many thanks
from jellyfin-plugin-sso.
It seems like your reverse proxy is misconfigured and not sending Jellyfin the right headers that lets it know that it is running over HTTPS. Jellyfin was then using "http" instead of "https" to generate the redirect url, which caused the issue.
See also: #129 and many more.
from jellyfin-plugin-sso.
It seems like your reverse proxy is misconfigured and not sending Jellyfin the right headers that lets it know that it is running over HTTPS. Jellyfin was then using "http" instead of "https" to generate the redirect url, which caused the issue.
See also: #129 and many more.
this is very likely because between my reverse proxy (traefik) and jellyfin, it communicates via the network with the container_name.http://jellyfin:8096
well now I have a permission problem, do I have to look elsewhere or can you help me?
in the jellyfin log I have this
[18:35:38] [INF] [22] Jellyfin.Plugin.SSO_Auth.Api.SSOController: SSO Controller initialized
[18:35:41] [INF] [22] Jellyfin.Plugin.SSO_Auth.Api.SSOController: SSO Controller initialized
[18:35:42] [WRN] [20] Jellyfin.Plugin.SSO_Auth.Api.SSOController: OpenID user f6141dcb-3d4e has one or more incorrect role claims: [{"Type": "amr", "Value": "pwd"}, {"Type": "azp", "Value": "jellyfin"}, {"Type": "client_id", "Value": "jellyfin"}, {"Type": "jti", "Value": "4a6dadce-2c66-4f1e-b830-a4dd54e3e975"}, {"Type": "name", "Value": "Prenom NOM"}, {"Type": "preferred_username", "Value": "prenom-nom"}, {"Type": "rat", "Value": "1692549338"}, {"Type": "sub", "Value": "f6141dcb-3d4e-"}]. Expected any one of: ["seedbox_users"]
from jellyfin-plugin-sso.
You can create a discussion post for the permission error. I can tell you that it looks like authelia is not sending over any group/role information. I'm not very good with authelia, so I won't be of much help with that side of things.
from jellyfin-plugin-sso.
You can create a discussion post for the permission error. I can tell you that it looks like authelia is not sending over any group/role information. I'm not very good with authelia, so I won't be of much help with that side of things.
I'll have a look at this, thank you very much. :D
from jellyfin-plugin-sso.
Related Issues (20)
- Error processing request. URL GET /sso/OID/r/authentik. HOT 33
- Improve login buttons (README) HOT 2
- domain name is wrong. HOT 4
- Manually set redirect URL HOT 16
- After installation plugin is in Status:NotSupported HOT 2
- authelia redirect link is wrong HOT 6
- Help with Authelia -- jwks HOT 4
- Authelia redirect link not working HOT 6
- Cannot login with Android app HOT 2
- Failed to Integrate with Active Directory Federation Service (ADFS) SAML HOT 8
- Checkbox to automatically redirect to login/oidc? HOT 1
- Jellyfin 10.9 with SSO stuck on "Logging in..." on android mobile app HOT 12
- Extension marked as "Not Supported" on jellyfin 10.9.2 HOT 1
- Cannot login with LDAP with SSO enabled HOT 1
- Add Zitadel to documentation HOT 2
- Google Auth - Endpoint is on a different host than authority: https://oauth2.googleapis.com/device/code HOT 1
- SSO not working with Jellyfin desktop application HOT 1
- Jellyfin only allows specific characters in username, SSO provider can send special characters HOT 3
- Stuck at White "Logging in..." screen with Authentik HOT 6
- Website port is not used for redirect HOT 10
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from jellyfin-plugin-sso.