Buco7854/jellyfin-plugin-sso v4.0.0.7 on GitHub

SSO account-linking fix

This release fixes self-service OIDC and SAML account linking and strengthens the security of the linking process.

Fixed account linking from /SSOViews/linking.
Bound linking attempts to the currently authenticated Jellyfin user.
Added short-lived, single-use OIDC state and SAML RelayState.
Added stricter SAML request, recipient, expiry and signature validation.
Prevented identities linked to another Jellyfin account from being silently reassigned.
Preserved the current Jellyfin session after successful linking.
Reworked the linking page into a simple responsive Jellyfin-style settings page.

Linking through ?isLinking=true is no longer supported.
Linking must be started while signed in from /SSOViews/linking.
Custom clients using the old linking URL must move to the authenticated StartLink flow.
During SAML linking, the identity provider must return the original RelayState and valid InResponseTo, Recipient and NotOnOrAfter values.
Attempting to link an identity belonging to another Jellyfin user now returns a conflict instead of reassigning it.

Existing provider configurations and identity mappings require no migration. Normal OIDC and SAML sign-in remains supported.

Full Changelog: v4.0.0.6...v4.0.0.7