From 9139bb6808fe74498b23e602e8c8fc8cd8199936 Mon Sep 17 00:00:00 2001
From: Cody Wright <acodywright@gmail.com>
Date: Fri, 26 Dec 2025 05:10:48 +0000
Subject: [PATCH] fix: add OIDC scopes to Jellyfin service

Also adds
<DisabledPushedAuthorization>true</DisablePushedAuthorization>, as
otherwise I get "Error preparing login: Unauthorized - Failed to push
authorization parameters"
---
 modules/services/jellyfin.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/services/jellyfin.nix b/modules/services/jellyfin.nix
index 83114b2..5306882 100644
--- a/modules/services/jellyfin.nix
+++ b/modules/services/jellyfin.nix
@@ -483,6 +483,7 @@ in
                       <string>groups</string>
                     </OidScopes>
                     <CanonicalLinks />
+                    <DisablePushedAuthorization>true</DisablePushedAuthorization>
                   </PluginConfiguration>
                 </value>
               </item>
@@ -732,7 +733,10 @@ in
         require_pkce = true;
         pkce_challenge_method = "S256";
         userinfo_signed_response_alg = "none";
+        # Jellyfin SSO plugin uses client_secret_post for token exchange
         token_endpoint_auth_method = "client_secret_post";
+        # Required OIDC scopes for Authelia to return group claims
+        scopes = ["openid" "profile" "email" "groups"];
       }
     ];
   };