• Have your a public DNS record set to point to the authentik server. im using auth.YourDomainName.com.
  
• a server to run you docker containers
  

• Install Docker:
  

• give docker permissions:
  

• install secret key generator:
  

• install wget:
  

• get file system ready:
  

• Install authenik:
  

• Create a sensible username and password as this will be accessible to the public.
  

• Once logged in, click Admin interface at the top right.
  
• On the left, click Applications > Outposts.
  
• You will see an entry called authentik Embedded Outpost, click the edit button next to it.
  
• change the authentik host to: authentik_host: https://auth.YourDomainName.com/
  
• click Update
  

• On the left, click directory > users
  
• Click Create
  
• Username: service
  
• Name: Service
  
• click on the service account you just created.
  
• then click set password. give it a sensible password that you can remember later
  

• on the left, click directory > groups
  
• Click create
  
• name: service
  
• click on the service group you just created.
  
• at the top click users > add existing users > click the plus, then add the service user.
  

• on the left click flow & stages > stages
  
• Click create
  
• Click identification stage
  
• click next
  
• Enter a name: ldap-identification-stage
  
• Have the fields; username and email selected
  
• click finish
  

• again, at the top, click create
  
• click password stage
  
• click next
  
• Enter a name: ldap-authentication-password
  
• make sure all the backends are selected.
  
• click finish
  

• at the top, click create again
  
• click user login stage
  
• enter a name: ldap-authentication-login
  
• click finish
  

• on the left click flow & stages > flows
  
• at the top click create
  
• name it: ldap-athentication-flow
  
• title: ldap-athentication-flow
  
• slug: ldap-athentication-flow
  
• designation: authentcation
  
• (optional) in behaviour setting, tick compatibility mode
  
• Click finish
  

• in the flows section click on the flow you just created: ldap-athentication-flow
  
• at the top, click on stage bindings
  
• click bind existing stage
  
• stage: ldap-identification-stage
  
• order: 10
  
• click create
  

• click bind existing stage
  
• stage: ldap-authentication-login
  
• order: 30
  
• click create
  

• click on the ldap-identification-stage > edit stage
  

• under password stage, click ldap-authentication-password
  
• click update
  

• on the left, click applications > providers
  
• at the top click create
  
• click LDAP provider
  
• click next
  
• name: LDAP
  
• Bind flow: ldap-athentication-flow
  
• search group: service
  
• bind mode: direct binding
  
• search mode direct querying
  
• click finish
  

• on the left, click applications > applications
  
• at the top click create
  
• name: LDAP
  
• slug: ldap
  
• provider: LDAP
  
• click create
  

• on the left, click applications > outposts
  
• at the top click create
  
• name: LDAP
  
• type: LDAP
  
• applications: make sure you have LDAP selected
  
• click create.
  

• on the left click directory > groups
  
• create 2 groups, Jellyfin Users & Jellyfin Admins. (case sensitive)
  
• on the left click directory > users
  
• create a user
  
• click on the user you just created and give it a password and assign it to the Jellyin User group. also add it to the Jellyfin admin group if you want
  

• open you jellyfin server
  
• click dashboard > plugins
  
• click catalog and install the LDAP plugin
  
• you may need to restart.
  
• click dashboard > plugins > LDAP
  

• under jellyfin user creation tick the boxes you want.
  
• click save
  

• In authentik admin click flows & stages > flows
  
• click default-authentication-flow
  
• at the top click stage binding
  
• you will see an entry called: default-authentication-mfa-validation, click edit stage
  
• make sure you have all the device classes selected
  
• not configured action: Continue
  

• on the left, click flows & stages > flows
  
• at the top click create
  
• Name: Duo Push 2FA
  
• title: Duo Push 2FA
  
• designation: stage configuration
  
• click create
  

• on the flow stage, click the flow you just created: Duo Push 2FA
  
• at the click stage bindings
  
• click create & bind stage
  
• click duo authenticator setup stage
  
• click next
  
• name: duo-push-2fa-setup
  
• authentication type: duo-push-2fa-setup
  
• you will need to fill out the 3 duo api fields.
  
• login to DUO admin: https://admin.duosecurity.com/
  
• in duo on the left click application > protect an application
  
• find duo api > click protect
  
• you will find the keys you need to fill in.
  
• configuration flow: duo-push-2fa
  
• click next
  
• order: 0
  

• click flows & stages > flows
  
• click ldap-athentication-flow
  
• click stage bindings
  
• click bind existing stage
  
• name: default-authentication-mfa-validation
  
• click update
  

• click users > add users
  
• give it a name to match the jellyfin user
  
• down the bottom, click add phone. this will send the user a text to download DUO app and will also include a link to active the the user on that duo device.
  
• when in each users profile in DUO you will see a code embedded in URL. something like this;
  

• you want to copy that code on the end.
  
• in authentik navigate to flows & stages > stages
  
• find the duo-push-2fa slow you created but dont click on it.
  
• next to it there will be a actions button on the right. click it to bring up import device
  
• select the user you want and the map it to the code you copied earlier.
  

(2023-09-29, 06:21 AM)Jellyfenmo Wrote: Thanks for taking the time to write this up! I was struggling with how to properly populate the LDAP Search Filter & this made it super easy.