For people asking for a way to run 2fa on jellyfin i have a solution. I will elaborate more if people are interested as not writing a guide for no reason. This method allows users to simply use their login credentials into the default jellyfin login page, and 1 second later your DUO app on your phone will buzz for a confirmation to sign-in. (meaning no redirects and this method 100% compatible with all clients)
install the LDAP plugin on jellyfin. install Authentik in your server with docker. create a DUO security account. in short, jellyfin query’s your Authentik LDAP server for ther user login, then LDAP will query DUO.
Unfortunately, DUO only allows 10 users with the free account, then you have to pay extra. of course with this method you are not bound to only use DUO, you could you a web-auth with your phones bio-metrics to sign-in instead of DUO. there are many ways you could query the users phone through Authentik, but DUO is the most continent.
You must log in or register to comment.
That’s pretty slick! I was messing around with using Authentik and Jellyfin and couldn’t get it to work. I’d be interested in the guide.
This has definitely been on my list of things to implement, so yeah would be interested in a guide.
Does this method work with other clients like the androidTV client and findroid etc?
This is a great approach, but I find myself not trusting Jellyfin’s preauth security posture. I’m just too concerned about a remote unauthenticated exploit that 2fa does nothing to prevent.
As a result, I’m much happier having Jellyfin access gated behind tailscale or something similar, at which point brute force attacks against Jellyfin directly become impossible in normal operation and I don’t sweat 2fa much anymore. This is also 100% client compatible as tailscale is transparent to the client, and also protects against brute force vs Jellyfin as direct network communication with Jellyfin isn’t possible. And of course, Tailscale has a very tightly controlled preauth attack surface… essentially none of you use the free/commercial tailscale and even self-hosting headscale I’m much more inclined to trust their code as being security-concscious than Jellyfin’s.
Sorry, it’s a bit early in my day, but I’m interested.
Could you elaborate on how tailscale acts as an access gate?
How is the balance between security and convenience when using tailscale?
(Full disclosure, I’m an idiot, but willing to learn)
Tailscale will create a personal VPN. So, only those devices where you are logged in with you Tailscale account can access that service.
For example, if I host a password manager behind Tailscale, only my laptop and phone can access it, where I am logged in to my Tailscale account and am connected to my VPN.
However, Tailscale’s backend is not open-source. They may not log all the data passed through, but they certainly can look at it. Use it only if you trust them. You can look into Headscale. It is an open source implementation of Tailscsle’s back end, which works with Tailscale’s apps.
Tailscale is very convenient, and is as secure as WireGuard protocol is.