Error contacting userinfo endpoint

[realSZ27]

I'm using Jellyfin 10.8.13 + Authentik.
The full error message it gives me is Error contacting userinfo endpoint: Forbidden Try logging in again. after clicking the login with sso button. It redirects me to and from authentik correctly, and I really have no idea whats causing the problem

Jellyfin Logs

jellyfin  | [16:14:54] [INF] [46] Jellyfin.Plugin.SSO_Auth.Api.SSOController: SSO Controller initialized
jellyfin  | [16:14:55] [WRN] [36] Jellyfin.Server.Middleware.ResponseTimeMiddleware: Slow HTTP Response from https://jellyfin.example.com/sso/OID/start/Authentik to my.ip in 0:00:00.6833951 with Status Code 302
jellyfin  | [16:14:56] [INF] [24] Jellyfin.Plugin.SSO_Auth.Api.SSOController: SSO Controller initialized
jellyfin  | [16:15:00] [WRN] [24] Jellyfin.Server.Middleware.ResponseTimeMiddleware: Slow HTTP Response from https://jellyfin.example.com/sso/OID/redirect/Authentik?code=f1a9bdd44cbc4e2c9e7de2f10bd87a39&state=bw1iHbUD5ez8chBgngEOkQ to my.ip in 0:00:04.1407299 with Status Code 400
jellyfin  | [16:15:01] [INF] [36] Jellyfin.Api.Auth.CustomAuthenticationHandler: CustomAuthentication was not authenticated. Failure message: Invalid token.
jellyfin  | [16:15:01] [INF] [36] Jellyfin.Api.Auth.CustomAuthenticationHandler: CustomAuthentication was not authenticated. Failure message: Invalid token.

Jellyfin Config

Everthing not included here is either blank or turned off.
I've also tried turning on Do Not Validate OpenID Endpoints (Insecure) to no avail.

Authentik Config

Provider

Property Mapping

Maybe I just missed something, but I haven't been able to figure it out. Also, since I just switched from unstable to stable, this is a fresh install. I also tried it on unstable Jellyfin, and had the same issue.

This Authentik instance works for all the other services I run, so I don't think the problem lies there.

[9p4]

Is Authentik using a GET or a POST to Jellyfin? The plugin only supports an OpenID GET request for the callback.

Furthermore, what is the content of your Authentik's .well-known/openid-configuration page? i.e. https://auth.example.com/application/o/jellyfin/.well-known/openid-configuration ?

[realSZ27]

I'm not sure how to check if Authentik is using post or get, but here's the output:

{
  "issuer": "https://auth.example.com/application/o/jellyfin/",
  "authorization_endpoint": "https://auth.example.com/application/o/authorize/",
  "token_endpoint": "https://auth.example.com/application/o/token/",
  "userinfo_endpoint": "https://auth.example.com/application/o/userinfo/",
  "end_session_endpoint": "https://auth.example.com/application/o/jellyfin/end-session/",
  "introspection_endpoint": "https://auth.example.com/application/o/introspect/",
  "revocation_endpoint": "https://auth.example.com/application/o/revoke/",
  "device_authorization_endpoint": "https://auth.example.com/application/o/device/",
  "response_types_supported": [
    "code",
    "id_token",
    "id_token token",
    "code token",
    "code id_token",
    "code id_token token"
  ],
  "response_modes_supported": [
    "query",
    "fragment",
    "form_post"
  ],
  "jwks_uri": "https://auth.example.com/application/o/jellyfin/jwks/",
  "grant_types_supported": [
    "authorization_code",
    "refresh_token",
    "implicit",
    "client_credentials",
    "password",
    "urn:ietf:params:oauth:grant-type:device_code"
  ],
  "id_token_signing_alg_values_supported": [
    "RS256"
  ],
  "subject_types_supported": [
    "public"
  ],
  "token_endpoint_auth_methods_supported": [
    "client_secret_post",
    "client_secret_basic"
  ],
  "acr_values_supported": [
    "goauthentik.io/providers/oauth2/default"
  ],
  "scopes_supported": [
    "groups",
    "openid"
  ],
  "request_parameter_supported": false,
  "claims_supported": [
    "sub",
    "iss",
    "aud",
    "exp",
    "iat",
    "auth_time",
    "acr",
    "amr",
    "nonce"
  ],
  "claims_parameter_supported": false,
  "code_challenge_methods_supported": [
    "plain",
    "S256"
  ]
}

[9p4]

It all looks good to me, and I can't seem to reproduce your issue. Can your Jellyfin container/machine/VM contact the Authentik endpoint?

[keesfluitman]

What I see wrong, is your Authentik setup.
Your Scopes, only have "groups" selected. You need to hold ctrl, and click all scopes you wish to send. i.e. email, openid, profile.

Now, I also have an issue, maybe someone can help me with that ;).
#192