From 09634f45305d27294a9a03c9633053d6047ae209 Mon Sep 17 00:00:00 2001
From: Cody Wright <acodywright@gmail.com>
Date: Fri, 26 Dec 2025 05:10:48 +0000
Subject: [PATCH] fix: add OIDC scopes to Jellyfin service

Also adds <DisabledPushedAuthorization>true</DisablePushedAuthorization>, as
otherwise I get "Error preparing login: Unauthorized - Failed to push
authorization parameters"
---
 modules/services/jellyfin.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/modules/services/jellyfin.nix b/modules/services/jellyfin.nix
index ee0af63..40f8832 100644
--- a/modules/services/jellyfin.nix
+++ b/modules/services/jellyfin.nix
@@ -550,6 +550,7 @@ in
                       <string>groups</string>
                     </OidScopes>
                     <CanonicalLinks />
+                    <DisablePushedAuthorization>true</DisablePushedAuthorization>
                   </PluginConfiguration>
                 </value>
               </item>
@@ -839,7 +840,15 @@ in
         require_pkce = true;
         pkce_challenge_method = "S256";
         userinfo_signed_response_alg = "none";
+        # Jellyfin SSO plugin uses client_secret_post for token exchange
         token_endpoint_auth_method = "client_secret_post";
+        # Required OIDC scopes for Authelia to return group claims
+        scopes = [
+          "openid"
+          "profile"
+          "email"
+          "groups"
+        ];
       }
     ];
   };