Incorrect role claims, missing role?

[wsw70]

I just configured Jellyfin to use Authelia as its SSO, I managed to get to the consent screen but I get an Error. Check permissions. afterward.

On the Jellyfin side, the relevant logs are (redacted data is XXX)

2024-09-22T20:01:56.850957096Z [20:01:56] [INF] [3] Jellyfin.Plugin.SSO_Auth.Api.SSOController: SSO Controller initialized
2024-09-22T20:01:57.239342005Z [20:01:57] [WRN] [3] Jellyfin.Plugin.SSO_Auth.Api.SSOController: OpenID user 17ac7f06-XXX has one or more incorrect role claims: [{"Type": "amr", "Value": "pwd"}, {"Type": "amr", "Value": "otp"}, {"Type": "amr", "Value": "mfa"}, {"Type": "azp", "Value": "jellyfin"}, {"Type": "client_id", "Value": "jellyfin"}, {"Type": "jti", "Value": "e5b2d6c9-XXX"}, {"Type": "name", "Value": "wojtek"}, {"Type": "preferred_username", "Value": "XXX"}, {"Type": "sub", "Value": "17ac7f06XXX"}]. Expected any one of: ["jellyfin-users"]

What does that mean? The user I am connecting as has both jellyfin-admins and jellyfin-users defined in Authelia.

[9p4]

Have you added the "groups" claim to the plugin? Can you upload your plugin .XML configuration file?

[wsw70]

Thank you for the follow-up. I am away from my laptop in the middle of nowhere until tomorrow so I just have limited info for now:

• I followed the steps listed in https://www.authelia.com/integration/openid-connect/jellyfin/. I am not sure where this claim is ?
• where can I find this xml file? (I was actually looking for it when trying to debug my problem on my own but never found it despite the authentication working to style extend (so it must be somewhere)). I use a docker install but a pointer for a Linux install will be enough for me to investigate

[9p4]

https://www.authelia.com/integration/openid-connect/jellyfin/#application , look at bullet point no 15 subpoint 10.

[wsw70]

Ah, thank you,I may have somehow missed 10 and 11 (no idea why, 12 was done).

I guess I can fix that in the XML file but I did not see it - should I create it? (the strange thing is that the configuration must be somewhere since the auth works until it does not)

I climbed on a tree to get some signal, connected to my server and after a find I see where the file is. My wife is making me get down or she is calling the firemen so I will finish tomorrow.

[wsw70]

It worked perfectly, thank you very much.

For readers who may stumble upon this question, I also had to do the steps in authelia/authelia#7472 (comment)

[wsw70]

As a side note - not related to this question but rather a long shot: as a power Jellyfin user, maybe you already tried to bypass the whole login screen and just directly use Authelia (as opposed to having the button from your doc). I asked a question at https://forum.jellyfin.org/t-how-to-bypass-the-login-screen-via-a-redirect but I am not sure that so many people use external identity providers