docs: Jellyfin LDAP-Auth integration (outpost + plugin) and authentik LDAP rules

serverAppConfigs-docs/Dankserver/Jellyfin.md

@@ -101,11 +101,50 @@ cgroup regardless of `GroupAdd=keep-groups`.
 
 ## Authentication
 
-- **Built-in auth (default):** Per-user libraries, parental controls, max bitrate limits. Manage via Dashboard → Users.
-- **Caddy basic auth:** Single login layer. Does not integrate with per-user Jellyfin permissions.
-- **LDAP/OIDC:** Available via plugins (LDAP-Auth, Jellyfin SSO). Integrates with Authentik, Keycloak, etc.
+- **Built-in auth:** per-user libraries, parental controls, max bitrate
+  limits. The local `dank` admin account is built-in and its password is
+  Frank's — never recorded in this repo (the bootstrap-era value no longer
+  authenticates on the live database).
+- **LDAP via Authentik (live 2026-09-01):** the LDAP-Auth plugin
+  authenticates users against the authentik LDAP outpost on Dankclaw — see
+  [[Authentik]] for the outpost unit, provider, and RBAC objects.
 
-For Dankserver, built-in auth is recommended. Use Caddy basic auth on top for external access.
+### LDAP-Auth plugin (v23.0.0.0, live 2026-09-01)
+
+- **Install from the GitHub releases zip** — `repo.jellyfin.org`'s stable
+  manifest path 404s here, so fetch
+  `jellyfin/jellyfin-plugin-ldapauth` release asset
+  `ldap-authentication_23.0.0.0.zip` from GitHub and unzip into
+  `config/plugins/LDAP-Auth_23.0.0.0/`. The config lives at
+  `config/plugins/configurations/LDAP-Auth.xml` — write it directly, then
+  restart the service.
+- **Live config:** server `192.168.0.143:389`, base DN
+  `dc=franksdank,dc=cloud`, bind DN
+  `cn=svc-jellyfin-ldap,ou=users,dc=franksdank,dc=cloud`, bind password =
+  the authentik outpost token (secret — the XML lives on the host only,
+  never in the repo), search filter
+  `(memberOf=cn=jellyfin_users,ou=groups,dc=franksdank,dc=cloud)`, admin
+  filter on `cn=jellyfin_admins,ou=groups,…`, `CreateUsersFromLdap=true`
+  (auto-create on first login).
+- **Attribute separator is a comma.** `LdapSearchAttributes` is
+  `Split(',')` in the plugin source — a semicolon-separated list
+  (`uid;cn;mail;displayName`) parses as ONE bogus attribute, the search
+  silently matches nothing, and the log says `Found no users matching X`.
+  Use `uid,cn,mail,displayName`.
+- **Username attribute is `cn`.** Authentik 2026.x maps `uid` to an opaque
+  per-user hash, not the username, so `uid=<name>` never matches. Set
+  `LdapUsernameAttribute=cn` (authentik exposes the username as `cn`).
+- **Verify with a throwaway user:** create a test member of
+  `jellyfin_users` in authentik, then
+  `POST /Users/AuthenticateByName` with headers `Content-Type:
+  application/json` **and** `X-Emby-Authorization: MediaBrowser
+  Client="…", Device="…", DeviceId="…", Version="10.11.0"` — both are
+  required in 10.11 (missing `X-Emby-Authorization` → 400). 200 + non-admin
+  policy = LDAP path works. Delete the test user from authentik **and**
+  Jellyfin afterward.
+- **Plugin load lines only show in `journalctl --user -u jellyfin.service`**
+  (`Loaded plugin: LDAP-Auth 23.0.0.0`) — `podman logs` does not carry the
+  loader lines in this image.
 
 ## Metadata Scraping