Skip to content
Pocket ID
v2.18.0GitHub

Jellyfin

Sign in to the Jellyfin media server with Pocket ID.

Requirements

Section titled “Requirements”

Create groups in Pocket ID

Section titled “Create groups in Pocket ID”

⚡ only:

  1. In Pocket ID, open Administration → User Groups and click Add Group.
  2. Add the two groups jellyfin_admins and jellyfin_users.

Create the client in Pocket ID

Section titled “Create the client in Pocket ID”
  1. In Pocket ID, open Administration → OIDC Clients and click Add OIDC Client.
  2. Enter a name such as Jellyfin and add the callback URL https://jellyfin.example.com/sso/OID/redirect/<PROVIDER>.
  3. Click Create and copy the Client ID and the Client secret. The client secret is only shown once.
  4. On the client’s Access tab, select the groups that may sign in under Allowed User Groups, or choose All Users.

Replace <PROVIDER> with the provider name you set in Jellyfin; this example uses PocketID. ⚡ On the Access tab, select the groups jellyfin_admins and jellyfin_users.

Configure Jellyfin

Section titled “Configure Jellyfin”
  1. Visit the plugin page (Administration Dashboard → My Plugins → SSO-Auth).
  2. Use the following values for the fields:
    • Name of OID Provider: <PROVIDER> (e.g. PocketID)
    • OID Endpoint: https://id.example.com
    • OpenID Client ID: the Client ID from Pocket ID
    • OID Secret: the Client secret from Pocket ID
    • Enabled: [X]
    • Enable Authorization by Plugin:
      • 😊 -> [ ]
      • ⚡ -> [X]
    • Enable All Folders: [ ] (Enable to publish all and new folders to every user)
    • Enabled Folders: Choose the folders/libraries which users will use
    • Roles:
      • 😊 -> [ ] (if you have a group for Jellyfin users, use that group, e.g. jellyfin_users)
      • ⚡ -> add both groups, one per line: 
        jellyfin_users
        jellyfin_admins
    • Admin Roles:
      • 😊 -> [ ]
      • ⚡ -> jellyfin_admins
    • Enable Role-Based Folder Access: [ ]
    • Enable Live TV RBAC: [ ]
    • Live TV Roles: [ ]
    • Live TV Management Roles: [ ]
    • Enable Live TV Access By Default: [ ]
    • Enable Live TV Management By Default: [ ]
    • Role Claim: groups
    • Request Additional Scopes: groups
    • Set default Provider: [ ]
    • Set default username claim: preferred_username
    • Set avatar url format: @{picture} (Leave blank if you don’t want avatar sync)
    • Disable OpenID HTTPS Discovery (Insecure): [ ]
    • Disable Pushed Authorization (Insecure): [ ]
    • Do Not Validate OpenID Endpoints (Insecure): [ ]
    • Do Not Validate OpenID Issuer Name (Insecure): [ ]
    • Scheme Override: https
    • Port Override: [ ]
  3. Click Save.
  4. Restart Jellyfin (General → Restart).

Custom login button on the main page

Section titled “Custom login button on the main page”

(Optional) In the Jellyfin administration UI, under Branding, add the following code in the Login disclaimer block (replace <PROVIDER>, e.g. with PocketID):

<form action="https://jellyfin.example.com/sso/OID/start/<PROVIDER>">
  <button class="raised block emby-button button-submit">
    Sign in with Pocket ID
  </button>
</form>

Then, add the following code in the Custom CSS code section:

a.raised.emby-button {
  padding: 0.9em 1em;
  color: inherit !important;
}


.disclaimerContainer {
  display: block;
}

Source: guide to create a login button on the login page

Sign in to Jellyfin

Section titled “Sign in to Jellyfin”

Done! You have successfully set up SSO for your Jellyfin instance using Pocket ID.

If your users already have accounts, as long as their Pocket ID username matches their Jellyfin ID, they will be signed in automatically. Otherwise, a new user will be created with access to all of your folders. You can change this in your configuration as desired.

This setup will only work if sign-in is performed using the https://jellyfin.example.com/sso/OID/start/<PROVIDER> URL. This URL initiates the SSO plugin and applies all the configurations we completed above.

Written for Jellyfin v10.11.2 and SSO-Auth-Plugin v4.0.0.2