[Feature] SSO_Support

README.md

@@ -31,7 +31,28 @@
 - Mobile-friendly design, for when you need to approve requests on the go!
 - Support for watchlisting & blacklisting media.
 
-With more features on the way! Check out our [issue tracker](https://github.com/fallenbagel/jellyseerr/issues) to see the features which have already been requested.
+### Single Sign-On (SSO) Support
+
+When configuring SSO, please note:
+
+- For OpenID Configuration URL:
+
+  - Remove `/.well-known/openid-configuration` from the URL
+  - Example: Use `https://auth.example.com` instead of `https://auth.example.com/.well-known/openid-configuration`
+
+- For Redirect URIs:
+
+  - Must end with `/login/oidc/callback`
+  - Example: `http://jellyseerr.example.com/login/oidc/callback`
+
+- Account Matching:
+
+  - Users are matched to existing Jellyseerr accounts based on email address
+  - If an SSO user's email matches an existing Jellyseerr account, they will be logged in as that user
+  - Example: If a Jellyseerr admin account uses `admin@example.com` and an SSO user with the same email logs in, they will receive admin privileges
+  - Consider this when setting up SSO to ensure proper access control
+
+    With more features on the way! Check out our [issue tracker](https://github.com/fallenbagel/jellyseerr/issues) to see the features which have already been requested.
 
 ## Getting Started
 

charts/jellyseerr-chart/Chart.yaml

@@ -3,7 +3,7 @@ kubeVersion: ">=1.23.0-0"
 name: jellyseerr-chart
 description: Jellyseerr helm chart for Kubernetes
 type: application
-version: 2.3.2
+version: 2.5.2
 appVersion: "2.5.1"
 maintainers:
   - name: Jellyseerr

jellyseerr-api.yml

@@ -149,6 +149,36 @@ components:
           type: string
         streamingRegion:
           type: string
+    OidcSettings:
+      type: object
+      properties:
+        providerName:
+          type: string
+          example: Keycloak
+        providerUrl:
+          type: string
+          example: https://auth.example.com
+        clientId:
+          type: string
+          example: your-client-id
+        clientSecret:
+          type: string
+          example: your-client-secret
+        userIdentifier:
+          type: string
+          example: email
+        requiredClaims:
+          type: string
+          example: email_verified
+        scopes:
+          type: string
+          example: id email
+        matchJellyfinUsername:
+          type: boolean
+          example: false
+        automaticLogin:
+          type: boolean
+          example: false
     MainSettings:
       type: object
       properties:
@@ -3782,6 +3812,79 @@ paths:
                   type: string
               required:
                 - password
+  /auth/oidc-login:
+    get:
+      security: []
+      summary: Redirect to the OpenID Connect provider
+      description: Constructs the redirect URL to the OpenID Connect provider, and redirects the user to it.
+      tags:
+        - auth
+      responses:
+        '302':
+          description: Redirect to the authentication url for the OpenID Connect provider
+          headers:
+            Location:
+              schema:
+                type: string
+                example: https://example.com/auth/oidc/callback?response_type=code&client_id=client_id&redirect_uri=https%3A%2F%2Fexample.com%2Fauth%2Foidc%2Fcallback&scope=openid%20email&state=state
+            Set-Cookie:
+              schema:
+                type: string
+                example: 'oidc-state=123456789; HttpOnly; max-age=60000; Secure'
+  /auth/oidc-callback:
+    get:
+      security: []
+      summary: The callback endpoint for the OpenID Connect provider redirect
+      description: Takes the `code` and `state` parameters from the OpenID Connect provider, and exchanges them for a token.
+      x-allow-unknown-query-parameters: true
+      parameters:
+        - in: query
+          name: code
+          required: true
+          schema:
+            type: string
+            example: '123456789'
+        - in: query
+          name: state
+          required: true
+          schema:
+            type: string
+            example: '123456789'
+        - in: cookie
+          name: oidc-state
+          required: true
+          schema:
+            type: string
+            example: '123456789'
+      tags:
+        - auth
+      responses:
+        '302':
+          description: A redirect to the home page if successful or back to the login page if not
+          headers:
+            Location:
+              schema:
+                type: string
+                example: /
+            Set-Cookie:
+              schema:
+                type: string
+                example: 'oidc-state=deleted; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT'
+  /auth/oidc-logout:
+    get:
+      security: []
+      summary: Redirect to the OpenID Connect provider logout page
+      description: Determines the logout redirect URL for to the OpenID Connect provider, and redirects the user to it.
+      tags:
+        - auth
+      responses:
+        '302':
+          description: Redirect to the logout url for the OpenID Connect provider
+          headers:
+            Location:
+              schema:
+                type: string
+                example: https://example.com/auth/oidc/invalidate_session
   /user:
     get:
       summary: Get all users

scripts/add-oidc-column.ts

@@ -0,0 +1,39 @@
+import Database from 'better-sqlite3';
+import path from 'path';
+
+try {
+    const db = new Database(path.join(process.cwd(), 'config/db/db.sqlite3'));
+
+    // Check if column exists
+    const columnExists = db.prepare(`
+        SELECT COUNT(*) as count
+        FROM pragma_table_info('user')
+        WHERE name = 'oidcId'
+    `).get().count > 0;
+
+    if (columnExists) {
+        console.log('oidcId column already exists in user table');
+        db.close();
+        process.exit(0);
+    }
+
+    // Create backup
+    db.backup(path.join(process.cwd(), 'config/db/db.sqlite3.backup'))
+        .then(() => {
+            console.log('Database backup created');
+
+            // Add the column
+            db.exec('ALTER TABLE user ADD COLUMN oidcId VARCHAR;');
+            console.log('Added oidcId column to user table');
+
+            db.close();
+        })
+        .catch((err) => {
+            console.error('Backup failed:', err);
+            db.close();
+            process.exit(1);
+        });
+} catch (err) {
+    console.error('Failed to modify database:', err);
+    process.exit(1);
+}

scripts/check-oidc-column.ts

@@ -0,0 +1,28 @@
+import Database from 'better-sqlite3';
+import path from 'path';
+
+try {
+    const db = new Database(path.join(process.cwd(), 'config/db/db.sqlite3'));
+
+    // Get table info
+    const tableInfo = db.prepare(`
+        SELECT * FROM pragma_table_info('user')
+    `).all();
+
+    console.log('User table structure:');
+    console.table(tableInfo);
+
+    // Check for any existing OIDC users
+    const oidcUsers = db.prepare(`
+        SELECT id, email, oidcId
+        FROM user
+        WHERE oidcId IS NOT NULL
+    `).all();
+
+    console.log('\nOIDC Users:', oidcUsers.length ? oidcUsers : 'None found');
+
+    db.close();
+} catch (err) {
+    console.error('Failed to read database:', err);
+    process.exit(1);
+}

server/constants/user.ts

@@ -3,4 +3,5 @@ export enum UserType {
   LOCAL = 2,
   JELLYFIN = 3,
   EMBY = 4,
+  OIDC = 5  // Add this line
 }

server/entity/User.ts

@@ -140,6 +140,9 @@ export class User {
 
   public warnings: string[] = [];
 
+  @Column({ nullable: true })
+  public oidcId?: string;
+
   constructor(init?: Partial<User>) {
     Object.assign(this, init);
   }