v2.5.13 — OIDC: admin linking, group→admin, template users, button control
An OIDC/SSO feature + fix release. In-place upgrade from any 2.5.x — no schema or data migration. Every new option is opt-in, so a default install behaves exactly as 2.5.12.
New
- Admins can link OIDC from the Setup page (#95). "Link a new provider" now runs a proper authenticated link flow: it opens the provider in a popup and links that identity to your already-signed-in account by subject, instead of routing through the sign-in resolver — which deliberately refuses to implicitly link admin accounts as an anti-takeover measure, and is why admins previously couldn't link. It refuses if the identity is already linked to a different Jellyfin user.
- IdP group → Jellyfin administrator (#96). A new per-provider toggle, "Elevate matching users to administrator" (off by default), grants admin on sign-in to any user whose IdP
groupsclaim matches an entry in Admin groups. Grant-only — it never auto-revokes — and every elevation is logged at WARN. Only enable it for an IdP you fully control: a compromised IdP that controls the groups claim could elevate any account. - Template user for auto-created accounts (#93). Optionally pick an existing user as a template; users auto-created on first OIDC sign-in copy that user's permissions and library access instead of Jellyfin's broad defaults. Leave it on "(Jellyfin defaults)" to keep current behaviour. Tip: use a restricted, non-admin user as the template.
- Separate "Enable SSO" from "Show built-in button" (#97). The provider toggle is now split: Enable SSO keeps the provider active (its sign-in URL keeps working, e.g. for your own custom button), while Show built-in button on login page controls whether the plugin renders its own "Sign in with…" button. You can hide the built-in button while keeping SSO live.
Fixed
- OIDC sign-in no longer silently bounces back to the login screen (#98). When the IdP authenticated you but the browser's follow-up
AuthenticateByNamefailed — commonly an auth proxy intercepting that request, or an expired bridge token — the bridge page used to redirect straight back to login with no explanation. It now shows the actual error, a hint to check your auth proxy, and a manual link, so the failure is diagnosable instead of an endless login loop.
Notes
- New admin-UI strings are translated across all 8 languages (en / de / es / fr / it / ja / pt / zh).
- A "sing-in-with-…" callback URL (#94) is not a bug — the callback path is derived from the provider's Display Name, so it just reflects a typo in that name. Rename the provider (e.g. to "PocketID") for a clean URL.
- Supports Jellyfin 10.11.x (10.11.9 and newer). Sigstore-signed + SLSA build-provenance attested.