Authelia plugin for Jellyfin

A plugin for Jellyfin that allows the use of Authelia as an authentication and authorization backend.

Description

Unlike the SSO plugin, this plugin uses Authelia HTTP API. The benefit of that approach is a native Jellyfin form and API for authentication. This means that any existing Jellyfin client should work with this plugin. The main drawback of this approach is that only username+password authentication is supported (no 2FA).

The plugin will automatically create a new Jellyfin user upon successful authentication. Any valid Authelia user can log in to Jellyfin.

Username case sensitivity

Jellyfin 12.0 treats usernames as case-insensitive: Alice and alice are the same Jellyfin account, and two users that differ only by capitalization cannot exist.

Authelia treats usernames as case-sensitive. Jellyfin stores each user under the casing they were created with, so the plugin authenticates using that stored username rather than whatever was typed:

1. The first login must use the exact casing Authelia expects. It creates the Jellyfin user (when enabled) under that same casing.
2. Every later login reuses it. Once Jellyfin holds test, signing in as TEST, Test or test all authenticate against Authelia as test.

A Jellyfin user's name is therefore the Authelia identity it logs in as, and renaming one in Jellyfin re-points it at the Authelia user of that name.

Two Authelia users whose names differ only by case cannot have separate Jellyfin accounts, since Jellyfin itself cannot store both.

Usage

1. Add https://raw.githubusercontent.com/nikarh/jellyfin-plugin-authelia/main/manifest.json as a new Jellyfin plugin repository
2. Install the Authelia Authentication plugin from the catalog
3. Configure the plugin by entering the URL of your Authelia server (can be either private or public), and a URL of your Jellyfin installation used in the Authelia configuration.yml rule.

Authelia configuration

This plugin uses /api/authz/auth-request endpoint for authentication. If your Authelia configuration.yml file contains server.endpoints.authz section it overrides the defaults, so you must explicitly enable auth-request endpoints:

server:
    endpoints:
        authz:
            auth-request:
                implementation: 'AuthRequest'

License

All files in this repository excluding the Authelia logo are licensed under an MIT license.

The Authelia logo in this repository is a modified version of the Authelia title logo with added paddings and a background, rasterized as a PNG, and is licensed under the Apache 2.0 license (see Authelia branding guide).