Error processing request when trying to click SSO login, URL schemes?

[pandaboy6621]

Hi guys. I am trying to set up this plugin with authentik and am getting an Error processing request when I try to login.
I connect to jellyfin with https://jellyfin.local.[redacted].net/ which is behind a traefik reverse proxy.

My URLs in authentik and Jellyfin are https://jellyfin.local.[redacted].net/sso/OID/start/authentik
and strict: https://jellyfin.local.[redacted].net/sso/OID/redirect/authentik

My authentik version is [2024.10.4]

Here are some logs that I found in Jellyfin:

[2024-12-14 23:04:57.490 -08:00] [INF] [24] Jellyfin.Plugin.SSO_Auth.Api.SSOController: SSO Controller initialized
[2024-12-14 23:04:58.637 -08:00] [ERR] [24] Jellyfin.Api.Middleware.ExceptionMiddleware: Error processing request. URL "GET" "/sso/OID/start/authentik".

[9p4]

What kind of SSL certificate are you using?

[pandaboy6621]

It's a cert from traefik that is generated using lets encrypt and a Cloudflare domain.

…

On Sun, Dec 15, 2024 at 4:38 PM 9p4 ***@***.***> wrote: What kind of SSL certificate are you using? — Reply to this email directly, view it on GitHub <#218 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AP3U57J2IWNLNMHQY3ZD63L2FYOKHAVCNFSM6AAAAABTUJJ5HCVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTCNJXGU2DGMA> . You are receiving this because you authored the thread.Message ID: ***@***.*** com>

[9p4]

Is Cloudflare proxying the requests (orange cloud or grey cloud in the CF dashboard?)

[pandaboy6621]

I think grey, the url I have only works when I'm using my local pi hole as dns, that Jellyfin url is not remotely accessible.

…

On Sun, Dec 15, 2024 at 5:29 PM 9p4 ***@***.***> wrote: Is Cloudflare proxying the requests (orange cloud or grey cloud in the CF dashboard?) — Reply to this email directly, view it on GitHub <#218 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AP3U57O65KBVJ6KR2FO3DVT2FYUFXAVCNFSM6AAAAABTUJJ5HCVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTCNJXGU3DMMY> . You are receiving this because you authored the thread.Message ID: ***@***.*** com>

[9p4]

Are you using a Jellyfin container?

[pandaboy6621]

Yes but it is configured as an external service in traefik because that container is on a different device.

…

On Sun, Dec 15, 2024 at 5:31 PM 9p4 ***@***.***> wrote: Are you using a Jellyfin container? — Reply to this email directly, view it on GitHub <#218 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AP3U57OETX6IFNVVPMEOC5L2FYUQRAVCNFSM6AAAAABTUJJ5HCVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTCNJXGU3DONY> . You are receiving this because you authored the thread.Message ID: ***@***.*** com>

[9p4]

Can you run docker exec -it jellyfin /bin/cat /etc/resolv.conf, replacing jellyfin with the name of your Jellyfin container (can be seen with docker ps)?

[pandaboy6621]

# This file can be edited; Docker Engine will not make further changes once it
# has been modified.

nameserver 127.0.0.11
options ndots:0

# Based on host file: '/etc/resolv.conf' (internal resolver)
# ExtServers: [1.1.1.1 8.8.8.8 host(2001:4860:4860::8888)]
# Overrides: []
# Option ndots from: internal```

[9p4]

Can you please upload the entire Jellyfin log file and your config once you make a request that fails?

[pandaboy6621]

Here: https://pastebin.com/D4Fz6qBw

[9p4]

You say that your SSO domain is set via a local DNS server? Can you set that nameserver in the Jellyfin container's /etc/resolv.conf with docker exec -it jellyfin echo nameserver 127.0.0.1 ">>" /etc/resolv.conf, replacing the IP with your DNS server's IP?

[pandaboy6621]

Ok let me try that

[9p4]

To be clear, this is not an issue with the plugin, but is instead an issue with your setup: the Jellyfin container is misconfigured and cannot resolve your Authentik server's DNS name.

[pandaboy6621]

I tried docker exec -it 212df0812179 echo nameserver 192.168.1.22 ">>" /etc/resolv.conf and then ran the cat command, It looks like it added my internal DNS at the .94 address # ExtServers: [192.168.1.94 8.8.8.8 host(2001:4860:4860::8888)] but my internal one I still the 127 one

[9p4]

Can you create a shell in the Jellyfin container and install dig (run the exec command with bash, then apt install dnsutils), and run dig [yourauthentikdomain]?

[pandaboy6621]

It looks like it is working now, should I still try and replace that 127 address?

…

On Mon, Dec 16, 2024 at 11:34 AM 9p4 ***@***.***> wrote: Can you create a shell in the Jellyfin container and install dig (run the exec command with bash, then apt install dnsutils), and run dig [yourauthentikdomain]? — Reply to this email directly, view it on GitHub <#218 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AP3U57LHNZ3VNLKTKBSFAMT2F4TLDAVCNFSM6AAAAABTUJJ5HCVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTCNJYGUZDENY> . You are receiving this because you authored the thread.Message ID: ***@***.*** com>

[9p4]

That fix was temporary, and once the Jellyfin container restarts, it will not work. You shouldn't replace any other addresses. You should look into adding a DNS server to a Docker container. As I don't personally use Docker, I can't really help any further.

[pandaboy6621]

I have an issue with my login now when I go to login with SSO it makes a user called Authentik Admins and 3a82b63653bde925b5b3639f313b005afc471d06bb3788d11d83384bd359d6a5, how do I configure my default user group that I made in Autentik (authentik general users) and (Authentik Admins) as Jellyfin Admins?

[pandaboy6621]

I figured that out, I had to set it to users username, however my groups are still not applying, I don't understand how to set the scopes in Authentik or the role fields in the plugin itself. Right now I made the Group scope mapping from the docs And I have those two user groups (mentioned above) each with one user in those groups.