How exactly does the self-help linking work?

[Brewsk11]

The server I'm working on has active users which I would like to preserve the settings/media watched status etc. after enabling SSO. My understanding is that through the self-help page, a user can link their existing jellyfin account JA to some SSO account SA (self-hosted Authentik in my case), such that logging to SA via SSO would redirect to jellyfin logged in as JA (pardon the details, I'm trying to make my point clear).

What happens in my case, is after clicking the plus button on the self-help page the user is correctly redirected to the SSO provider, but they are logged in as a new provisioned user with sub as username. This would be expected when logging in via SSO without linking the account first.

The full plugin config

<?xml version="1.0" encoding="utf-8"?>
<PluginConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
  <SamlConfigs />
  <OidConfigs>
    <item>
      <key>
        <string>authentik</string>
      </key>
      <value>
        <PluginConfiguration>
          <OidEndpoint>https://REDACTED/application/o/jellyfin/</OidEndpoint>
          <OidClientId>REDACTED</OidClientId>
          <OidSecret>REDACTED</OidSecret>
          <Enabled>true</Enabled>
          <EnableAuthorization>true</EnableAuthorization>
          <EnableAllFolders>false</EnableAllFolders>
          <EnabledFolders />
          <AdminRoles>
            <string>jellyfin-admins</string>
          </AdminRoles>
          <Roles>
            <string>jellyfin-users</string>
          </Roles>
          <EnableFolderRoles>true</EnableFolderRoles>
          <EnableLiveTvRoles>false</EnableLiveTvRoles>
          <EnableLiveTv>false</EnableLiveTv>
          <EnableLiveTvManagement>false</EnableLiveTvManagement>
          <LiveTvRoles />
          <LiveTvManagementRoles />
          <FolderRoleMappings>
            <FolderRoleMappings>
              <Role>jellyfin-users</Role>
              <Folders>
                <string>8f01ecb48aebREDACTED</string>
                <string>435afda8be42REDACTED</string>
                <string>4d6940d6f6d4REDACTED</string>
              </Folders>
            </FolderRoleMappings>
          </FolderRoleMappings>
          <RoleClaim>groups</RoleClaim>
          <OidScopes />
          <DefaultProvider> </DefaultProvider>
          <NewPath>true</NewPath>
          <CanonicalLinks>
            <item>
              <key>
                <string>USERNAME_REDACTED</string> <!-- preferred_username from the provider -->
              </key>
              <value>
                <guid>6b65a117-8180-465c-b438-b241fa4594fa</guid>
              </value>
            </item>
            <item>
              <key>
                <string>a90436c3569cfe525b8fb442f6e394d9f7651bed89303b2aa99fdREDCTED</string> <!-- The sub value -->
              </key>
              <value>
                <guid>542213b0-3934-4156-868c-0737096501a7</guid>
              </value>
            </item>
          </CanonicalLinks>
          <DefaultUsernameClaim>sub</DefaultUsernameClaim>
          <DisableHttps>false</DisableHttps>
          <DoNotValidateEndpoints>false</DoNotValidateEndpoints>
          <DoNotValidateIssuerName>false</DoNotValidateIssuerName>
        </PluginConfiguration>
      </value>
    </item>
  </OidConfigs>
</PluginConfiguration>

It seems to me as if the

          <CanonicalLinks>
            <item>
              <key>
                <string>USERNAME_REDACTED</string> <!-- preferred_username from the provider -->
              </key>
              <value>
                <guid>6b65a117-8180-465c-b438-b241fa4594fa</guid>
              </value>
            </item>
            <item>
              <key>
                <string>a90436c3569cfe525b8fb442f6e394d9f7651bed89303b2aa99fdREDCTED</string> <!-- The sub value -->
              </key>
              <value>
                <guid>542213b0-3934-4156-868c-0737096501a7</guid>
              </value>
            </item>
          </CanonicalLinks>

element is created erronously, but I couldn't make it work with manual experiments.

Maybe I'm misunderstanding what the self-help page linking is doing?

[Brewsk11]

Recently I posted about a related issue: #159 (comment)
IIRC this was the outcome when I changed the username claim from sub to preferred_username and tried to link accounts with the same preferred_username claim as the Jellyfin username.

[Brewsk11]

Also the logs. I did the following:

• removed the sub username user (starting from clean setup with just the existing users),
• logged in to JF via standard login,
• tried to connect the SSO account via self-help page,
• was redirected to a freshly created user with sub username.

Logs from 2 last steps

[19:14:36] [INF] SSO Views Controller initialized
[19:14:36] [INF] SSO Views Controller initialized
[19:14:36] [INF] SSO Views Controller initialized
[19:14:36] [INF] SSO Views Controller initialized
[19:14:36] [INF] SSO Views Controller initialized
[19:14:36] [INF] SSO Controller initialized
[19:14:36] [INF] SSO Controller initialized
[19:14:36] [ERR] Error processing request. URL GET /sso/oid/links/6d50c3f952684c57a3d67373REDACTED.
System.InvalidOperationException: The AuthorizationPolicy named: 'DefaultAuthorization' was not found.
   at Microsoft.AspNetCore.Authorization.AuthorizationPolicy.CombineAsync(IAuthorizationPolicyProvider policyProvider, IEnumerable`1 authorizeData, IEnumerable`1 policies)
   at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context)
   at Jellyfin.Api.Middleware.QueryStringDecodingMiddleware.Invoke(HttpContext httpContext)
   at Swashbuckle.AspNetCore.ReDoc.ReDocMiddleware.Invoke(HttpContext httpContext)
   at Swashbuckle.AspNetCore.SwaggerUI.SwaggerUIMiddleware.Invoke(HttpContext httpContext)
   at Swashbuckle.AspNetCore.Swagger.SwaggerMiddleware.Invoke(HttpContext httpContext, ISwaggerProvider swaggerProvider)
   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
   at Jellyfin.Api.Middleware.RobotsRedirectionMiddleware.Invoke(HttpContext httpContext)
   at Jellyfin.Api.Middleware.LegacyEmbyRouteRewriteMiddleware.Invoke(HttpContext httpContext)
   at Microsoft.AspNetCore.ResponseCompression.ResponseCompressionMiddleware.InvokeCore(HttpContext context)
   at Jellyfin.Api.Middleware.ResponseTimeMiddleware.Invoke(HttpContext context, IServerConfigurationManager serverConfigurationManager)
   at Jellyfin.Api.Middleware.ExceptionMiddleware.Invoke(HttpContext context)
[19:14:36] [ERR] Error processing request. URL GET /sso/saml/links/6d50c3f952684c57a3d67373REDACTED.
System.InvalidOperationException: The AuthorizationPolicy named: 'DefaultAuthorization' was not found.
   at Microsoft.AspNetCore.Authorization.AuthorizationPolicy.CombineAsync(IAuthorizationPolicyProvider policyProvider, IEnumerable`1 authorizeData, IEnumerable`1 policies)
   at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context)
   at Jellyfin.Api.Middleware.QueryStringDecodingMiddleware.Invoke(HttpContext httpContext)
   at Swashbuckle.AspNetCore.ReDoc.ReDocMiddleware.Invoke(HttpContext httpContext)
   at Swashbuckle.AspNetCore.SwaggerUI.SwaggerUIMiddleware.Invoke(HttpContext httpContext)
   at Swashbuckle.AspNetCore.Swagger.SwaggerMiddleware.Invoke(HttpContext httpContext, ISwaggerProvider swaggerProvider)
   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
   at Jellyfin.Api.Middleware.RobotsRedirectionMiddleware.Invoke(HttpContext httpContext)
   at Jellyfin.Api.Middleware.LegacyEmbyRouteRewriteMiddleware.Invoke(HttpContext httpContext)
   at Microsoft.AspNetCore.ResponseCompression.ResponseCompressionMiddleware.InvokeCore(HttpContext context)
   at Jellyfin.Api.Middleware.ResponseTimeMiddleware.Invoke(HttpContext context, IServerConfigurationManager serverConfigurationManager)
   at Jellyfin.Api.Middleware.ExceptionMiddleware.Invoke(HttpContext context)
[19:14:37] [INF] SSO Controller initialized
[19:14:38] [INF] SSO Controller initialized
[19:14:40] [INF] Is request linking: True
[19:14:41] [INF] SSO Controller initialized
[19:14:41] [INF] SSO user a90436c3569cfe525b8fb442f6e394d9f7651bed89303b2aa99fdREDACTED doesn't exist, creating...
[19:14:41] [INF] SSO user link doesn't exist, creating...
[19:14:41] [INF] Auth request created...
[19:14:41] [INF] Current/Max sessions for user a90436c3569cfe525b8fb442f6e394d9f7651bed89303b2aa99fdREDACTED: 0/0
[19:14:41] [INF] Creating new access token for user f43d31f3-ecbf-4156-85fa-308d154a0075
[19:14:42] [INF] WS IP_REDACTED request

[Brewsk11]

Since this post is not getting traction, let me simplify the question: how do I link an existing Jellyfin user with an identity provider (Authentik) user?

[Brewsk11]

Self-hosted authentik in a separate container.

[9p4]

Are those long usernames intentional?

[Brewsk11]

The long username is given for the provisioned user while trying to link the accounts. The long ID is the sub property in OpenID connect. My actual Jellyfin username is a 5 character name (in green on the ss).

Is the Jellyfin username supposed to be set as the mapped property before linking?

See the "default username claim" in my config.

[9p4]

Try setting it to preferred_username?

[Brewsk11]

What you are proposing implies that the mapped property has to match the Jellyfin username, correct?
If so, then I can workaround the problem (which is: different authentik and Jellyfin usernames) by defining a custom property per-user.