Desktop Client with Authentik OAuth

[dnightbane]

Definitely a good guide for LDAP with 2FA, thank you!

That post also made me realize my initial post was missing a few more details, apologies about that.

The authentik flow for this domain is set to OAUTH with plex.tv (Figured this would be an easy way to allow my users to choose whichever they want without having to maintain multiple credentials) so when a user goes to https://jellyfin.domain.com they are instantly redirected to authentik which pops a login for plex.tv. This works as expected in the browser but I suspect may not be a supported configuration for the clients so LDAP and different credentials may be the route I need to go.

My nginx config
server {
listen 443 ssl;
http2 on;
server_name jellyfin.domain.com;
include /etc/nginx/conf.d/https.conf;

## The default client_max_body_size is 1M, this might not be enough for some posters, etc.
client_max_body_size 20M;

# Security / XSS Mitigation Headers
add_header X-Content-Type-Options "nosniff";

# Permissions policy. May cause issues with some clients
# add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), battery=(), bluetooth=(), camera=(), clipboard-read=(), display-capture=(), document-domain=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), payment=(), publickey-credentials-get=(), serial=(), sync-xhr=(), usb=(), xr-spatial-tracking=()" always;

# Content Security Policy
# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
# Enforces https content and restricts JS/CSS to origin
# External Javascript (such as cast_sender.js for Chromecast) must be whitelisted.
add_header Content-Security-Policy "default-src https: data: blob: ; img-src 'self' https://* ; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.gstatic.com https://www.youtube.com blob:; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; frame-ancestors 'self'; font-src 'self'";

access_log /var/log/nginx/jellyfindomain/jellyfin.access.log;
error_log /var/log/nginx/jellyfindomain/jellyfin.error.log;

location / {
# Proxy main Jellyfin traffic
proxy_pass http://jellyfin:8096;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Protocol $scheme;
proxy_set_header X-Forwarded-Host $http_host;

# Disable buffering when the nginx proxy gets very resource heavy upon streaming
proxy_buffering off;
}

location /socket {
# Proxy Jellyfin Websockets traffic
proxy_pass http://jellyfin:8096;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Protocol $scheme;
proxy_set_header X-Forwarded-Host $http_host;
}
}