SSO Authentik don't look for groups

[cowarol]

Describe the bug
If i login with the admin user which is in the admin, jellyfin-admin group. Then he remove my admin permissions on Jellyfin. (OIDC)

To Reproduce
Steps to reproduce the behavior:

sign in with sso with your staps

Expected behavior
Can you try your gide end see of it works?

Configuration
` GNU nano 7.2 SSO-Auth.xml

Authentik https://domain/application/o/jellyfin/.well-known/openid-configuration secret secret true true true jellyfin-admin false false false false groups ["groups"] true false false false authentik https://domain/application/o/jellyfin/.well-known/openid-configuration secret secret true true true false false false false groups https true cowarol e401bc88-84af-4dc4-9403-63ba82bc36cb false true true `

Versions (please complete the following information):

• OS: docker
  NAME="Debian GNU/Linux" VERSION_ID="12" VERSION="12 (bookworm)" VERSION_CODENAME=bookworm ID=debian HOME_URL="https://www.debian.org/" SUPPORT_URL="https://www.debian.org/support" BUG_REPORT_URL="https://bugs.debian.org/"
• Browser: chrome
• Jellyfin Version: 10.10.7
• Plugin Version: 3.5.2.4

Additional context
The plugin is clean installed en i followed your guid on github and authentik

in the logs i see only that he lookt for the user
2025-09-25 19:16:37.487 +00:00] [INF] [18] Jellyfin.Plugin.SSO_Auth.Api.SSOController: SSO Controller initialized [2025-09-25 19:16:42.075 +00:00] [INF] [18] Jellyfin.Api.Auth.CustomAuthenticationHandler: AuthenticationScheme: "CustomAuthentication" was challenged. [2025-09-25 19:16:46.835 +00:00] [INF] [18] Jellyfin.Plugin.SSO_Auth.Api.SSOController: SSO Controller initialized [2025-09-25 19:16:55.789 +00:00] [INF] [17] Jellyfin.Plugin.SSO_Auth.Api.SSOController: Is request linking: False [2025-09-25 19:16:56.408 +00:00] [INF] [17] Jellyfin.Plugin.SSO_Auth.Api.SSOController: SSO Controller initialized [2025-09-25 19:16:56.412 +00:00] [INF] [21] Jellyfin.Plugin.SSO_Auth.Api.SSOController: Auth request created... [2025-09-25 19:16:56.412 +00:00] [INF] [21] Emby.Server.Implementations.Session.SessionManager: Current/Max sessions for user "cowarol": 0/0 [2025-09-25 19:16:56.412 +00:00] [INF] [21] Emby.Server.Implementations.Session.SessionManager: Creating new access token for user e401bc88-84af-4dc4-9403-63ba82bc36cb [2025-09-25 19:16:56.960 +00:00] [INF] [40] Emby.Server.Implementations.HttpServer.WebSocketManager: WS "172.16.0.20" request [2025-09-25 19:17:03.359 +00:00] [INF] [18] Emby.Server.Implementations.HttpServer.WebSocketManager: WS "172.16.0.20" closed [2025-09-25 19:17:03.409 +00:00] [INF] [40] Emby.Server.Implementations.Session.SessionManager: Logging out access token "daede5d7f7bd496e896382ec28f73f52" [2025-09-25 19:17:16.568 +00:00] [INF] [18] Jellyfin.Server.Implementations.Users.UserManager: Authentication request for "cowarol" has succeeded. [2025-09-25 19:17:16.568 +00:00] [INF] [18] Emby.Server.Implementations.Session.SessionManager: Current/Max sessions for user "cowarol": 0/0 [2025-09-25 19:17:16.568 +00:00] [INF] [18] Emby.Server.Implementations.Session.SessionManager: Creating new access token for user e401bc88-84af-4dc4-9403-63ba82bc36cb [2025-09-25 19:17:16.676 +00:00] [INF] [18] Emby.Server.Implementations.HttpServer.WebSocketManager: WS "172.16.0.20" request [2025-09-25 19:18:41.913 +00:00] [INF] [45] Emby.Server.Implementations.HttpServer.WebSocketManager: WS "172.16.0.20" closed [2025-09-25 19:18:42.597 +00:00] [INF] [15] Emby.Server.Implementations.HttpServer.WebSocketManager: WS "172.16.0.20" request [2025-09-25 19:18:44.520 +00:00] [INF] [41] Emby.Server.Implementations.HttpServer.WebSocketManager: WS "172.16.0.20" closed [2025-09-25 19:18:44.566 +00:00] [INF] [15] Emby.Server.Implementations.Session.SessionManager: Logging out access token "43c34d8ea9714a75aca54b7579e4e904"

[cowarol]

sso.xml

[9p4]

Please format your logs correctly, and send me your Authentik configuration.

[solomonould]

dunno if it helps but i have this working fine on my setup with authentik, the first roles is blank, then admin roles is admin (for you jellyfin-admin) then role claim is groups

[solomonould]

also just to note, you MAY need a matching role in authentik as i have a group admins, and role admins, so possible it grabs the role not the group or something but give that a go