This is a SSO system in building for my selfhosted setup, currently it only covers Jellyfin + radarr + sonarr. The premise is simple, to allow users to access these services with one password even if the services don't provide support for big SSO's like keycloak. Since my services stand behind a nginx proxy, I put together a system where the backend, frontend and nginx work together to give the user maximum comfort.
Lunatria Second Devlog:
After getting Lunatria working in the browser, I wanted the Jellyfin mobile app to work as well. Unfortunately, my browser authentication flow couldn’t be reused directly inside the app, so I had to figure out how the mobile client authenticated differently.
My first hypothesis was that Jellyfin explicitly identified whether a request came from the browser or the mobile app. To test this, I created a temporary domain (observe-jellyfin.lunatria.com) and logged every request passing through Nginx (Screenshot 1 shows the logging setup).
However, this turned out not to be the case.
After inspecting requests from both the web and mobile app, I started comparing the User-Agent headers. After going through tens of requests, I finally noticed the only consistent difference: two tiny letters in the User-Agent — wv, meaning WebView (Screenshot 2 shows the two User-Agent strings).
After looking it up, I learned that wv indicates an embedded Android WebView. At first I wasn’t sure this was the real distinction, but after testing across multiple devices, I confirmed it: wv effectively separates mobile app traffic from web traffic.
To handle this, I added a variable in the Nginx configuration to split routing between web and app traffic (Screenshot 3 shows the config change).
However, authentication was still an issue.
On the web version of Jellyfin, I route traffic through a special HTML page that uses the SSO session to fetch and store the Jellyfin auth token. In the mobile app, this approach doesn’t work.
After some consideration, I decided to route all mobile app traffic directly to Jellyfin except for one endpoint: the authentication endpoint.
On Jellyfin, this is /Users/AuthenticateByName. I route this request to my backend instead (Screenshot 4 shows the routing logic). The backend uses the SSO credentials provided by the user in the Jellyfin app, retrieves the corresponding Jellyfin auth token (stored securely and encrypted), and responds in place of Jellyfin.
And success — the Jellyfin mobile app is now fully accessible through Lunatria.
(You can check the Nginx configs in the repo.)
Hii, this is my first devlog about my project which is pride and honor. Let me introduce it first. I have a home server, sitting next to the router in my house. I use it for many things but one of them is entertainment. For that I use Jellyfin for streaming, radarr and sonarr for adding to the library. The issue I ran into is when granting access to these apps for friends and family I had to send 3 username+passwords and along the way as I add more services more and more passwords would be needed. So I decided to look for a SSO. There are many selfhosted options which do work well, but all had 1 downside. They need the service itself to support SSO’s. I thought about contributing to those services to integrate SSO’s but at the time I was too scared and didn’t have enough knowledge to be sure of what I am even doing. So I decided to write my
own. What I came up with was a backend - for handling API’s and DB requests for user’s credentials, nginx - a proxy and routing to redirect authorization to my backend, frontend- a status dashboard, administration, and a login page for users to log in. Before stardance I managed to create the status page, form for users to log in, administration panel for adding users and adding credentials for them, as well as proxying Jellyfin, Sonarr and Radarr but only when using a browser. During stardance I want to expand and improve my SSO. This devlog covers the first improvements I made during stardance. I improved the UI of creating new users as well as adding the option to remove users. I also improved the UI of Credential management and adding the option to remove credentials, and adding the “Service Access” page to add and remove access for users to certain services. This was pretty easy as I had all the blocks in place, create a API for deleting users, credential, and access, create a API for fetching username’s. And building the UI was just expanding already existing features. I look forward to expanding more features.
LonleySailor
