Stuck at White "Logging in..." screen with Authentik about jellyfin-plugin-sso

[Eschguy]

Yep, that did the trick. Appreciate the help.

[9p4]

Please send me the plugin configuration as well as the reverse proxy configuration.

[Eschguy]

Config

<?xml version="1.0" encoding="utf-8"?>
<PluginConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
  <SamlConfigs />
  <OidConfigs>
    <item>
      <key>
        <string>authentik</string>
      </key>
      <value>
        <PluginConfiguration>
          <OidEndpoint>https://my.authentik.domain/application/o/jellyfin</OidEndpoint>
          <OidClientId>redacted</OidClientId>
          <OidSecret>redacted</OidSecret>
          <Enabled>true</Enabled>
          <EnableAuthorization>true</EnableAuthorization>
          <EnableAllFolders>true</EnableAllFolders>
          <EnabledFolders />
          <AdminRoles>
            <string>authentik_admins</string>
          </AdminRoles>
          <Roles />
          <EnableFolderRoles>false</EnableFolderRoles>
          <EnableLiveTvRoles>false</EnableLiveTvRoles>
          <EnableLiveTv>false</EnableLiveTv>
          <EnableLiveTvManagement>false</EnableLiveTvManagement>
          <LiveTvRoles />
          <LiveTvManagementRoles />
          <FolderRoleMappings />
          <RoleClaim>groups</RoleClaim>
          <OidScopes>
            <string>["groups"]</string>
          </OidScopes>
          <NewPath>true</NewPath>
          <CanonicalLinks />
          <DefaultUsernameClaim>preferred_username</DefaultUsernameClaim>
          <DisableHttps>false</DisableHttps>
          <DoNotValidateEndpoints>false</DoNotValidateEndpoints>
          <DoNotValidateIssuerName>false</DoNotValidateIssuerName>
        </PluginConfiguration>
      </value>
    </item>
  </OidConfigs>
</PluginConfiguration>

Caddyfile entry

jellyfin.my.tld {
        tls internal
        encode zstd gzip
        reverse_proxy   172.16.0.205:8096
}

[9p4]

When logging in, can you open inspect element and take a look at the browser console/network requests? Any requests that fail? Any interesting log lines?

[Eschguy]

Interesting

An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can remove its sandboxing. 
The loading of “https://jellyfin.my.tldweb/index.html” in a frame is denied by “X-Frame-Options“ directive set to “deny“.
This error page has no error code in its security info [aboutNetError.mjs:867:13](chrome://global/content/aboutNetError.mjs)

If I log in via the username/password method it works just fine though.

[9p4]

Please add header X-Frame-Options SAMEORIGIN in your Caddy configuration.