search

9p4 / jellyfin-plugin-sso

This plugin allows users to sign in through an SSO provider (such as Google, Microsoft, or your own provider). This enables one-click signin.
GNU General Public License v3.0
628 stars 29 forks source link

"Enable Authorization by Plugin: false" should be able to create users with no permissions #147

Open mardom1 opened 1 year ago

mardom1 commented 1 year ago

Describe the bug Even though both "Enable Authorization by Plugin" and "Enable All Folders" are disabled, a new user is created with access to all libraries. The help text below "Enable Authorization by Plugin" states however, that "If false, the user will start with no permissions and an administrator will add permissions".

When I enable "Enable Authorization by Plugin" and leave "Enable All Folders" disabled, the new user has no permissions as expected. After giving access to a library, and logging out and back in, the library access is gone again, even though the help text says "The permissions of existing users will not be rewritten on subsequent logins".

To Reproduce Issue:

  1. Disable both options in the plugin settings.
  2. Login with SSO (new user)
  3. New user gets created with access to all libraries

Issue 2:

  1. Enable "Enable Authorization by Plugin", disable "Enable All Folders"
  2. Login with SSO (new user)
  3. See that new user has no permissions
  4. Give user permission to a library
  5. Refresh and see that user now has permissions
  6. Logout and sign-in again using SSO
  7. User has no permissions again

Expected behavior Behavior according to help text. No permissions when both option are disabled. When "Enable Authorization by Plugin" is enabled, do not overwrite permissions after each login.

Screenshots Not needed.

Configuration According to description.

Versions (please complete the following information):

9p4 commented 1 year ago

I think that the docs are unclear. The permissions will always be overridden on login (this is intended) if "Enable Authorization by Plugin" is enabled. If it is disabled, it will not modify any permissions for any user, and instead use the Jellyfin defaults (all access all the time).

Thank you for bringing the documentation issue to light.

mardom1 commented 1 year ago

Ah, ok. That makes sense if permissions are given through SSO.

Would it be possible to add an option to auto-create users without any permissions, but still keep access management in Jellyfin? Nothing important, though.

9p4 commented 1 year ago

Related: #111

brilthor commented 8 months ago

This is a pretty big deal for attaching to google for auth, unless I'm missing something if you setup google for auth anyone with a google account can then login and will default have access to all the media.

I know with gitlab users get created when they login but are disabled until an admin enables them