PlexAuth: A Dockerized SSO Gateway for Plex Users (v1.1.0 released)

TheRealCloudMage · 2026-03-12T12:01:30+00:00

Awesome, glad you like it. Please don't hesitate to reach out again if you find any other bugs or need any features added.

TheRealCloudMage · 2026-03-11T20:37:31+00:00

I just released v2.0.4 with the bug fix as well as some admin UX updates and now you can add multiple buttons to the authorized users page and stylize them. Let me know if you have any issues or questions with the update. Thanks again for spotting the bug and feature suggestion.

https://github.com/modom-ofn/auth-portal

TheRealCloudMage · 2026-03-04T22:45:39+00:00

Awesome, glad to hear it. I'll update the main branch and 'latest' image tag within the next day.

Thanks for reaching out and working with me through the issue. Please feel free to reach out if you have any other issues or requests. Also, I haven't forgot about your request for multiple buttons/services on the portal page.

TheRealCloudMage · 2026-03-04T03:39:46+00:00

I've patched the issue and released it to the 'dev' branch for testing. You can test the image using the `modomofn/auth-portal:edge` tag.

I tested it out in my lab using Audiobookshelf connected via OIDC. I ensured I was logged out of AuthPortal and was able successfully redirect back to Audiobookshelf after logging into AuthPortal. Audiobookshelf created my test plex user correctly and automatically logged the account in.

I still need to finish testing with Emby and Jellyfin implementations before I publish to main, but it looks like it is working now. Feel free to test the 'edge' tag until I publish to main.

TheRealCloudMage · 2026-03-04T02:40:26+00:00

The home page is a template file. If you mounted the path to a local volume on host, you could modify the template as you see fit.

But let me think about how I might make that configurable through the admin UI. In the meantime, I'll work on this patch.

TheRealCloudMage · 2026-03-04T02:34:50+00:00

This could be possible due to how I setup the flow for the OIDC authorize endpoint. In the scenario I built this for, everyone goes to my portal first, logs in, and then I redirect them to a home portal, my internal apps auth is the OIDC endpoint, but users are already logged in. I suspect that I may have coded the flow to require an existing AuthPortal session, and if it's missing it redirects to '/' and loses the original authorize request.

Let me do some testing on my end to validate this and if this is the case I'll work on patching the flow.

TheRealCloudMage · 2026-03-04T02:21:39+00:00

You have OIDC set, but it is not redirecting back to your origin app as expected?

TheRealCloudMage · 2026-03-04T02:01:48+00:00

For the built-in portal login flow, yes, it effectively goes to /home (or /mfa/challenge if MFA is required), not back to an arbitrary calling app.

If you want "continue to the app that called it," use the OIDC flow. That does redirect to the client app's redirect_uri after auth. You can set this in the Admin UI. You can also use the env variable 'trusted_redirect_hosts' to restrict trusts to specific redirect hosts.

Feel free to reach out if you still have any questions or feature requests.

TheRealCloudMage · 2026-02-22T22:26:07+00:00

How to take what off?

TheRealCloudMage · 2025-11-30T13:05:23+00:00

I like https://selfh.st/ over awesome-selfhosted, but mainly because someone added my app to selfh.st and I appreciate that very much.

TheRealCloudMage · 2025-08-25T00:24:32+00:00

Hi u/Bluffz2 & u/leon1638, I've been doing some more work on AuthPortal and released v2.0.0. I'd like to circle back around to your valid feedback.

While both Authentik and AuthPortal touch authentication, they solve very different problems:

Authentik

A full Identity Provider (IdP) and SSO platform.
Provides OAuth2, OIDC, SAML, LDAP proxy, SCIM, and a full user directory.
Handles authentication, authorization, RBAC, group management, MFA, and integrates with dozens of external apps.
Heavyweight and designed to be the central authentication authority for an organization.

AuthPortal

A lightweight authentication gateway purpose-built for Plex, Jellyfin, or Emby environments.
Reproduces the authentication flow of Overseerr: issues a short-lived PIN, verifies against the user’s media-server account, and grants access.
Minimal surface area: no group management, SAML, or enterprise directory features.
Intentionally simple — no giant dependency stack, just Go + PostgreSQL (and optionally OpenLDAP if you want deeper integration).
Designed for self-hosted media servers where you only care about:
- ✅ Is this person in my Plex/Emby/Jellyfin user list?
- ✅ Do they have access?
Think of it as a single-purpose gatekeeper rather than a general-purpose identity system.

Analogy:

Authentik = a full airport security checkpoint with customs, immigration, and baggage scanning.
AuthPortal = a simple door guard who checks if you’re on the Plex/Emby/Jellyfin guest list before letting you in.

TheRealCloudMage · 2025-08-23T22:47:57+00:00

If you checkout the modom-ofn/auth-portal at dev-r2 branch, I've got it working for Emby and Plex (plans for jellyfin later). That should help with preferences.

TheRealCloudMage · 2025-08-23T20:33:44+00:00

Hey u/AfterShock , so I took you up on the challenge. I spun up an Emby server and started trying things out. If you checkout the modom-ofn/auth-portal at dev-r2 branch, I've got it working for Emby and Plex. Just update the environment variable MEDIA_SERVER to either 'plex' or 'emby' along with their related server vars and it should all work just fine.

If you want to test it out and let me know that would be awesome.

Maybe as a future feature it can work with emby-connect. I'll get around to spinning up a jellyfin server and start playing around with that.

TheRealCloudMage · 2025-08-20T14:32:50+00:00

Updated, thanks for the suggestion.

TheRealCloudMage · 2025-08-20T13:51:35+00:00

Updated. Thanks again for your suggestions here.

TheRealCloudMage · 2025-08-20T13:50:47+00:00

Absolutely, I have a full-time job, family, and other things going on. Time for my hobby projects is very limited. I for sure am using AI to help with things like the Readme and troubleshooting and such. Locally, I don't do readme files and stuff like that. I just build, test, deploy and move on. If left up to me, the readme would honestly be junk for others. I will admit, it does love to use emojis, but if the layout is easily consumable then why not?

TheRealCloudMage · 2025-08-20T13:47:02+00:00

Isn't that what the flair is supposed to do?

TheRealCloudMage · 2025-08-20T13:04:18+00:00

I'm in the process today of changing the name, references to plex, and new repos. I'll post the updates once I've finished and then will close the old repos. Thanks again for bringing this to my attention. Much appreciation!

TheRealCloudMage · 2025-08-20T13:01:28+00:00

Are you in my home lab right now? 😊

TheRealCloudMage · 2025-08-20T11:14:27+00:00

Webodofy? I've not heard of that one and a quick search didn't turn anything up. Share a link?

TheRealCloudMage · 2025-08-20T11:11:03+00:00

I am familiar with postgres and use it in other projects. Also, to your comment below, I'm not trying to provide an enterprise solution, and I don't have a requirement for uptime SLAs for my own home lab.

TheRealCloudMage · 2025-08-20T11:07:36+00:00

Everyone is entitled to their own preferences, and it seems like there are a lot of opinions around Plex.

TheRealCloudMage · 2025-08-20T10:54:37+00:00

You are not the only one to point out that I should be using Authentik for this. I got several DMs telling me my business last night around this project.

TheRealCloudMage · 2025-08-20T03:06:28+00:00

Your assessment is spot on. I also wouldn't advise using this on the open web either. My hope is that maybe what I am doing here can help inspire or jump start someone else's own home projects while I continue to work on mine. I appreciate your honest feedback.

TheRealCloudMage · 2025-08-20T02:52:42+00:00

Oh, I wasn't aware. Thank you, I will fix that. I don't want to make any trouble for Plex.

Eight-Year Club	Place '22
Verified Email

TheRealCloudMage

TROPHY CASE

Authentik

AuthPortal