All pages
Powered by GitBook
1 of 13

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

SSO

Organizr Single Sign On

Summary

Single Sign on is used to log into other services when you log into Organizr. You must be using the same username and password to log into Organizr as you would use to log into Plex, Ombi, Tautulli, etc...

Overseerr SSO

Overseerr Single Sign On

Summary

Using SSO with Overseerr allows you to access the Overseerr UI using only one sign in.

Settings / System Settings / Single Sign-On / Overseerr

Overseerr Fallback User & Overseerr Password not used yet.

Type

Purpose

Overseerr URL

URL for your Server's Overseerr Instance

Token

API Key for Overseerr

Overseerr Fallback User

If your user doesn't have an Overseerr account, Organizr will use this account

Overseerr Password

Password for the above account

Enable

Enable Overseerr SSO

Plex SSO

Plex Single Sign On

Summary

If you are using Plex as the main driving factor for your Organizr instance, you will want to enable Plex as backend choice to login via Plex credentials.

Settings / System Settings / Main / Authentication

Change the Authentication type to Organizr DB + Backend. Choose Plex as the Authentication Backend. Use the Retrieve button to fill in the Plex Token and Plex Machine.

The other two toggles are optional:

Now that Plex is setup to be the backend for Organizr, you can head over to the SSO section for Plex

Settings / System Settings / Single Sign-On / Plex

If Plex account was made using Facebook/Google - YOU HAVE TO USE OAUTH to sign in

Plex SSO will only work with Plex reverse proxied as a subdirectory and not as a subdomain. Fill out the Plex Token and Plex Machine (They should already be filled in if you did the above step). You can use the retrieve buttons to fill these out. Toggle the enabled switch to turn it on.

If not using Plex OAuth - For Admin Account - Make sure passwords match in Organizr and Plex

Plex SSO doesn't work if Plex Reverse Proxy is a subdomain - It must be on the same domain as Organizr

Plex Reverse Proxy (Sub-Directory)

Contents of Proxy.conf

Type

Purpose

Enable Plex oAuth

This will bring up a Plex login screen that will flow credentials through plex.tv

Strict Plex Friends

Enabling this option will only allow people from your friends list that have access to the server that you selected for Plex Machine

Type

Purpose

Plex Token

Token to authenticate with Plex Servers

Plex Machine

Plex Machine ID for your specific server

Admin Username

Username or Email for Organizr and Plex Admin account

Enable

Enable Plex SSO

location /plex/ {
  proxy_pass http://ip-of-plex:32400/;
  include /path/to/proxy.conf;
}
if ($http_referer ~ /plex/) {
  rewrite ^/web/(.*) /plex/web/$1? redirect;
}
client_max_body_size 10m;
client_body_buffer_size 128k;
proxy_bind $server_addr;
proxy_buffers 32 4k;
#Timeout if the real server is dead
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
# Advanced Proxy Config
send_timeout 5m;
proxy_read_timeout 240;
proxy_send_timeout 240;
proxy_connect_timeout 240;
proxy_hide_header X-Frame-Options;
# Basic Proxy Config
proxy_set_header Host $host:$server_port;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_redirect  http://  $scheme://;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_no_cache $cookie_session;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";

Tautulli SSO

Tautulli Single Sign On

Summary

The Tautulli SSO module works best if you are using Plex as your Organizr Backend.

Settings / System Settings / Single Sign-On / Tautullli

Tips

You first need to make sure that Allow Plex Admin & Allow Guest Access to Tautulli are enabled in the Web Interface portion of the Settings page.

To enable Tautulli SSO for your users, head to Tautulli Users page and click Edit mode and click the Lock Icon for each user you want to enable SSO for.

NZBHydra2 SSO

NZBHydra2 Single Sign On with Proxy Auth

Summary

NZBHydra has as of version 2.13.13 the ability to authorize using a similar method as Grafana.

In NZBHydra's settings we need to set a few values. The Auth header has to have the same as the one in the NGINX reverse proxy (example to follow), while the Secure ip ranges should be set to the nginx ip.

Type

Purpose

Multiple URL's

Tautulli URL's for multiple instances

Enable

Enable Tautulli SSO

Proxy Auth SSO

Proxy Auth Single Sign On

Summary

Using SSO with Proxy Auth allows you to access an apps UI using only one sign in.

All of these type of apps work the same way. For the reverse proxy you need to add the following:

auth_request /organizr-auth/X; #Change the X to whatever group you want to allow access
auth_request_set $auth_user $upstream_http_x_organizr_user;
proxy_set_header X-WEBAUTH-USER $auth_user;

Jellyfin SSO

Jellyfin Single Sign On

Summary

Using SSO with Jellyfin allows you to access the Jellyfin UI using only one sign in.

Settings / System Settings / Single Sign-On / Jellyfin

Tips

SSO doesn't work if Reverse Proxy is a subdomain - It must be on the same domain as Organizr

Ombi SSO

Ombi Single Sign On

Summary

Using SSO with Ombi allows you to access the Ombi UI using only one sign in.

Settings / System Settings / Single Sign-On / Ombi

Petio SSO

Petio Single Sign On

Summary

Using SSO with Petio allows you to access the Petio UI using only one sign in.

Settings / System Settings / Single Sign-On / Petio

Calibre SSO

Calibre Single Sign On with Auth Proxy

Summary

Calibre added support to Auth via header in v0.6.5. You need to set the Calibre settings in the Admin Configuration.

The Reverse Proxy Header Name should be the header you set in your reverse proxy config.

Grafana SSO

Grafana Single Sign On with Proxy Auth

Summary

SSO with Grafana is a combination of reverse proxy configuration and some settings in grafana.ini or with environment variables.

Grafana.ini

Komga SSO

Komga Single Sign On

Summary

Using SSO with Komga allows you to access the Komga UI using only one sign in.

Settings / System Settings / Single Sign-On / Komga

Environment variables

Notes

You need to flip the enabled to true (it's disabled by default) and you should set the whitelist to the IP of your Organizr install so the header can only come from it. To read more about this, see Grafana's docs.

[auth.proxy]
enabled = true             
header_name = X-WEBAUTH-USER
header_property = username
auto_sign_up = true
;ldap_sync_ttl = 60
whitelist = 172.27.1.131
;headers = Email:X-User-Email, Name:X-User-Name
-e GF_AUTH_PROXY_ENABLED=true \             
-e GF_AUTH_PROXY_HEADER_NAME="X-WEBAUTH-USER" \
-e GF_AUTH_PROXY_HEADER_PROPERTY="username" \
-e GF_AUTH_PROXY_AUTO_SIGN_UP=true \
-e GF_AUTH_PROXY_LDAP_SYNC_TTL=60 \
-e GF_AUTH_PROXY_WHITELIST="172.27.1.131" \
-e GF_AUTH_PROXY_HEADERS="Email:X-User-Email, Name:X-User-Name"

Type

Purpose

Ombi URL

URL for your Server's Ombi Instance

Token

API Key for Ombi

Ombi Fallback User

If your user doesn't have an Ombi account, Organizr will use this account

Ombi Fallback Password

Password for the above account

Enable

Enable Ombi SSO

Fill out the URL for your Ombi install (it can be the local IP or local DNS and port) and copy your API key from Ombi's settings to the Token box. Toggle the enabled switch to turn it on.

If you are doing a subdomain for Ombi, go to your tabs and set the Tab URL to:

Proxy Type

URL

Subdomain (ombi.domain.com)

Directory (domain.com/ombi)

https://domain.com/ombi

Tips

Please make sure that you have the following options enabled in Ombi.

By enabling those options, your users under User Management should have the User Type as Plex User now.

Petio Fallback User & Petio Password not used yet.

Type

Purpose

Petio URL

URL for your Server's Petio Instance

Token

API Key for Petio

Petio Fallback User

If your user doesn't have an Petio account, Organizr will use this account

Petio Password

Password for the above account

Enable

Enable Petio SSO

You will need to update your calibre.conf file as documented on the Proxy Auth SSO page.

Here is an example calibre.conf file for a subdomain of https://domain.com/calibre

location /calibre {
        proxy_bind              $server_addr;
        proxy_pass              http://127.0.0.1:8083;
        proxy_set_header        Host            $http_host;
        proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header        X-Scheme        $scheme;
        proxy_set_header        X-Script-Name   /calibre;  # IMPORTANT: path has NO trailing slash
        auth_request /organizr-auth/4; #Change the X to whatever group you want to allow access
        auth_request_set $auth_user $upstream_http_x_organizr_user;
        proxy_set_header X-WEBAUTH-USER $auth_user;
}

Type

Purpose

URL

URL for your Server's Komga Instance

Minimum Authentication

Group Needed to use SSO

Enable

Enable Komga SSO

Tab Setup

Komga needs a specific Tab URL in order to function

Type
Value

Tab URL

http://komga-domain/?xAuthToken={komga}

Replace komga-domain with the actual domain of your Komga instance.

Type

Purpose

Jellyfin API URL

URL for your Server's Jellyfin API Instance

Jellyfin SSO URL

URL for to pass to Jellyfin for SSO

Enable

Enable Jellyfin SSO

Troubleshooting SSO

Troubleshooting Single Sign On

Summary

In the event that something isn't working as expected, here we will short where to start looking to troubleshoot.

Debug Area

In the drop down under your username in the top right there is an option for the Debug Area. From here use the drop down at the top and choose the SSO option you are trying to troubleshoot.

SSO Values

misc.oAuthLogin = Current Login used oAuth

misc.rememberMe = Remember me button was toggle on login

misc.rememberMeDays = Cookie Length in days

%SSO_TYPE%.enabled: false = SSO module enable status

%SSO_TYPE%.cookie: false = Cookie status

%SSO_TYPE%.url: false = URL of SSO module

%SSO_TYPE%.api: false = The API key status if set

%SSO_TYPE%.backend: false = Plex Backend is not enabled

%SSO_TYPE%.machineID = Used for Plex - machineID status

https://ombi.domain.com/auth/cookie
misc:

oAuthLogin: true

rememberMe: true

rememberMeDays: 7

plex:

enabled: true

cookie: true

machineID: true

token: true

plexAdmin: email

strict: true

oAuthEnabled: true

backend: true

ombi:

enabled: true

cookie: true

url: http://docker.home.lab:3579/

api: true

tautulli:

enabled: true

cookie: false

url: http://docker.home.lab:8181

%SSO_TYPE%.token = The API key status if set

%SSO_TYPE%.plexAdmin = Either username or email

%SSO_TYPE%.strict = Status of Plex Friends status

%SSO_TYPE%.oAuthEnabled = oAuth enable status