Plex/Tautulli/Overseerr with custom scope mapping in Authentik

[JesseWebDotCom]

Can you explain how you did that (simply starting with organizr)? Rght now I access my external organizr url, authenticate with plex through authentik and then I'm stuck at the organizr login page (where I can click "login with plex" to login - which is the extra step I want to avoid). Thanks

Provider:

• type = proxy provider
• authentication flow = default-authentication-flow
• authorization flow = implicit
• subtype = forward auth (single application)

[JesseWebDotCom]

Here is how I created the scope mapping and added it to the provider:

1. Customisation | property Mappings - I added a scope mapping:

• name = add the X-Plex-Token to requests
• scope name = ak_proxy
• description = auto login to Organizr using Plex auth by adding the X-Plex-Token to requests

Expression = I used the "Plex" code you posted here: #1

2. Applications | Providers | organizr proxy provider - then Advanced protocol settings:

• tried with cert blank and with authentik self-signed cert
• Selected the "add the X-Plex-Token to requests" scope and then clicked update

3. Inprivate browser - tried the authentication (as mentioned in my first comment)

[JesseWebDotCom]

FWIW: Here is my middleware:

http:
  middlewares:
    authentik:
      forwardauth:
        address: https://auth.DOMAIN_NAME_HERE.com/outpost.goauthentik.io/auth/traefik
        trustForwardHeader: true
        authResponseHeaders:
          - X-authentik-username
          - X-authentik-groups
          - X-authentik-email
          - X-authentik-name
          - X-authentik-uid
          - X-authentik-jwt
          - X-authentik-meta-jwks
          - X-authentik-meta-outpost
          - X-authentik-meta-provider
          - X-authentik-meta-app
          - X-authentik-meta-version

and my organizr labels:

    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.organizr.rule=Host(`organizr.${DOMAINNAME_CLOUD_SERVER}`)"
      - "traefik.http.routers.organizr.middlewares=authentik@file"
      - "traefik.http.routers.organizr.service=organizr"
      - "traefik.http.services.organizr.loadbalancer.server.port=80"    
      - "traefik.http.services.organizr.loadbalancer.passHostHeader=true" 

[ToaHartor]

For Organizr, I didn't use any scope mapping for it (and didn't search a lot tbh), as I found it was much simpler to do it using a Proxy auth.
Basically in your Organizr settings, go to the Proxy Auth tab. You can enable it there, add to the whitelist the Traefik IP (with a /32), and the Auth Proxy email header is X-authentik-email.
You can also override the logout, which allows to logout of Authentik while logging out of Organizr. The logout URL would therefore be https://{YOUR_ORGANIZR_DOMAIN}/outpost.goauthentik.io/sign_out.
However, I think you will still have to synchronize the Plex account with the Organizr db.

In Authentik, the provider is a Proxy Provider, set to Forward auth (single application) with the URL set to your Organizr URL.

I think your middleware and Organizr labels are fine though.