Kanidm Support about jellyfin-plugin-sso

[TheRealGramdalf]

It does technically work, but full support via the issue with identityModel is a must for me due to origin checks. In any case, many thanks for the awesome plugin either way!

[TheRealGramdalf]

Please check if commit d51e506 fixes this issue. You can use the nightly release of the plugin (0.0.0.0).

With the following configuration:

<?xml version="1.0" encoding="utf-8"?>
<PluginConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
  <SamlConfigs />
  <OidConfigs>
    <item>
      <key>
        <string>kanidm</string>
      </key>
      <value>
        <PluginConfiguration>
          <OidEndpoint>https://auth.domain.tld/oauth2/openid/jellyfin-aer_rs</OidEndpoint>
          <OidClientId>jellyfin-aer_rs</OidClientId>
          <OidSecret>...</OidSecret>
          <Enabled>true</Enabled>
          <EnableAuthorization>false</EnableAuthorization>
          <EnableAllFolders>false</EnableAllFolders>
          <EnabledFolders />
          <AdminRoles />
          <Roles />
          <EnableFolderRoles>false</EnableFolderRoles>
          <EnableLiveTvRoles>false</EnableLiveTvRoles>
          <EnableLiveTv>false</EnableLiveTv>
          <EnableLiveTvManagement>false</EnableLiveTvManagement>
          <LiveTvRoles />
          <LiveTvManagementRoles />
          <FolderRoleMappings />
          <RoleClaim />
          <OidScopes />
          <NewPath>false</NewPath>
          <CanonicalLinks>...</CanonicalLinks>
          <DisableHttps>false</DisableHttps>
          <DoNotValidateEndpoints>false</DoNotValidateEndpoints>
          <DoNotValidateIssuerName>false</DoNotValidateIssuerName>
        </PluginConfiguration>
      </value>
    </item>
  </OidConfigs>
</PluginConfiguration>

And the nightly plugin version as of Feb 20, 2024, everything seems to work fine. I'll mark everything as done, so feel free to close this when it can make it into a release.

[9p4]

v3.5.2.3 is released with the changes.

[josephdecock]

If anyone in this thread wants to take a look, we released a preview of the next version of IdentityModel today that includes an updated error message that shows both the endpoint and allowed base addresses.

[9p4]

As both tasks are complete, can this issue be closed?

[TheRealGramdalf]

The latter hasn't made it into a client tool release yet, so I can't actually test the custom claims as of yet. It should be fine as long as jellyfin-sso supports custom claims represented as a JSON array, ssv, or csv: docs

I would still like a little more insight on the former if possible - it's labeled as insecure in the settings, so I'd like to know the reason behind it so I can make an informed decision.

[TheRealGramdalf]

One other thing that I forgot was how it requests claims - ideally the group scope shouldn't be required for login (which I believe is the case currently) - I believe the "correct" implementation is to request it as an additional scope after initial authentication has occurred and set groups/roles according to the claims therein.
As it stands right now (iirc), the group scope is required for the user to log in to their account, and if not present, the user is unable to log in, period - even if they have manually defined groups or otherwise.

Hopefully I can give a more concrete example once the client tools are updated and I can actually test things out.

[lf-]

The latter hasn't made it into a client tool release yet, so I can't actually test the custom claims as of yet. It should be fine as long as jellyfin-sso supports custom claims represented as a JSON array, ssv, or csv: docs

I would still like a little more insight on the former if possible - it's labeled as insecure in the settings, so I'd like to know the reason behind it so I can make an informed decision.

It does!

Set up kanidm with:

kanidm system oauth2 update-claim-map jellyfin_oauth groups jellyfin_admin admin

I haven't granted the group scope so this shouldn't be necessary.

[TheRealGramdalf]

Just as a status update, the only thing left really is the over validation of URIs (see the original post) - once that has been resolved I'm happy with everything as it is.

[9p4]

KanIDM does work when the option to bypass the check is enabled, right?

[josephdecock]

IdentityModel validates that the endpoints use an expected base address. It uses the issuer as the default for this validation, but you can add additional base addresses in the configuration. See IdentityModel/IdentityModel#553 (comment).

I'm going to update the error message to improve discoverability of this feature in our upcoming next release, but you should be able to use the existing configuration options to solve this problem today.

[josephdecock]

Can you please give that a try and let me know if it works for you?

[9p4]

Please check if commit d51e506 fixes this issue. You can use the nightly release of the plugin (0.0.0.0).