# Comprehensive Guide: Setting Up Authentik with DUO 2FA and LDAP for Jellyfin Clients **URL:** \ **Category:** Self-hosted Applications\ **Tags:** jellyfin, authentik, ldap\ **Created:** [October 16, 2024, 11:44am UTC](https://forum.hhf.technology/t/comprehensive-guide-setting-up-authentik-with-duo-2fa-and-ldap-for-jellyfin-clients/221 "2024-10-16T11:44:05Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\ **Post date:** [October 16, 2024, 11:44am UTC](https://forum.hhf.technology/t/comprehensive-guide-setting-up-authentik-with-duo-2fa-and-ldap-for-jellyfin-clients/221/1 "2024-10-16T11:44:05Z")
I wanted multifactor authentication on Jellyfin especially for my administrators which is unfortunately a missing feature natively. Unfortunately configuring Authelia Forward Authentication or an SSO solution with OpenID Connect (OIDC) or Security Assertion Markup Language (SAML) would break native apps on non-PC devices due to drastically changing the authentication flow. I wanted a solution that taps on Jellyfin’s native authentication flow and only introduces a “pause” after clicking the log in button, which can be handled by any client, while waiting for the Duo push to be approved. While this solution does not save a lot more space, I was inspired by [Jellyfin, Authentik, DUO. 2FA solution](https://forum.jellyfin.org/t-jellyfin-authentik-duo-2fa-solution-tutorial) but wanted a smaller, non Authentik, alternative. Also, Docker Hub images for [DuoAuthProxy](https://duo.com/docs/authproxy-reference) were all outdated, so this was also an opportunity to bring it into my [list of automatically updating images powered by Gitlab CI/CD](https://gitlab.com/users/jarylc/projects). [Just looking for the Alpine-based DuoAuthProxy docker image built by me? Click here!](https://hub.docker.com/r/minimages/duoauthproxy) Note: Since we will be accessing everything locally in this guide, even all within the docker network, I will not be going through setting up LDAP transit encryption (i.e. Secure LDAPS and StartTLS) as it would be out of scope. ## More Demos ### Android app login video Your browser does not support the video element. ## Prerequisites 1. [Jellyfin](https://jellyfin.org/) on Docker set-up prior 2. A free/paid account with [Duo](https://duo.com/) and access to the admin portal ## Steps ### Starting LLDAP Replace the following accordingly - dc=example,dc=com (people normally follow their domain (i.e. [example.com](http://example.com) for this)) - REPLACE\_ME\_WITH\_YOUR\_OWN\_JWT\_SECRET (this can be any long string really, string length is debatable and out of scope) - REPLACE\_ME\_WITH\_YOUR\_OWN\_KEY\_SEED (this can be any long string really, string length is debatable and out of scope) ```lua docker run -d \ --name=LLDAP \ --network auth \ -p 17170:17170 \ -e LLDAP_LDAP_BASE_DN=dc=example,dc=com \ -e LLDAP_JWT_SECRET=REPLACE_ME_WITH_YOUR_OWN_JWT_SECRET \ -e LLDAP_KEY_SEED=REPLACE_ME_WITH_YOUR_OWN_KEY_SEED \ -v /path/to/data:/data \ --restart unless-stopped \ lldap/lldap:stable ``` Reference: [https://github.com/lldap/lldap](https://github.com/lldap/lldap) ### Configuring LLDAP Visit the frontend at port 17170 and create a service user for DuoAuthProxy accordingly, you can replace the values if needed. ![image](https://forum-cdn.hhf.technology/original/1X/c54147d4710ce01eaffefa1c1452acf9626ef5e0.png) For the sake of this example, the password of the svc-duoauthproxy user is `password` Make sure to add the user to either lldap\_strict\_readonly (read-only) or lldap\_password\_manager (allow password change on Jellyfin) groups ![image](https://forum-cdn.hhf.technology/original/1X/832b1c3bca5dfe1ef5e48f6b8b4a336e01f40d31.png) ### Creating Duo application Access your [Duo admin console](https://admin.duosecurity.com/) Go to Applications → Protect an Application Search for `proxy` and protect an `LDAP Proxy` application ![image](https://forum-cdn.hhf.technology/original/1X/da71322bd992ed62b20e81cfe4316ff569da5fc1.png) Copy the credentials to prepare for the next step ![image](https://forum-cdn.hhf.technology/original/1X/01188854d0ce59a366fba443f500266e13497093.png) ### Configuring DuoAuthProxy If you are using my image, it is necessary to craft the configuration file first Replace the following keys accordingly - bind\_dn - service\_account\_username - service\_account\_password - search\_dn - ikey - skey - api\_host ```ini ; Complete documentation about the Duo Auth Proxy can be found here: ; https://duo.com/docs/authproxy_reference [main] log_stdout=true [ad_client] host=LLDAP port=3890 auth_type=plain bind_dn=uid=svc-duoauthproxy,ou=people,dc=example,dc=com service_account_username=svc-duoauthproxy service_account_password=password search_dn=ou=people,dc=example,dc=com username_attribute=uid at_attribute=mail [ldap_server_auto] ikey=DIXXXXXXXXXXXXXXXXXX skey=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX api_host=api-XXXXXXXX.duosecurity.com failmode=secure client=ad_client port=1812 exempt_primary_bind=false exempt_ou_1=uid=svc-duoauthproxy,ou=people,dc=example,dc=com ``` Reference: [https://duo.com/docs/authproxy\_reference](https://duo.com/docs/authproxy_reference) ### Starting DuoAuthProxy ```lua docker run -d \ --name=DuoAuthProxy \ --network auth \ -v /path/to/authproxy.cfg:/app/conf/authproxy.cfg \ --restart unless-stopped \ minimages/duoauthproxy ``` Feel free to use alternatives as well or even [host it natively or generate your own image using the official instructions](https://duo.com/docs/authproxy-reference#installation). ### Preparing Jellyfin I would assume you would already have Jellyfin set up, add Jellyfin to the auth network by re-running the container while adding `–network auth` argument to the docker run ### Installing LDAP Authentication Jellyfin Plugin Note: I’m currently using the unstable version of Jellyfin (10.9.0) as of posting, I had to use the unstable plugins repository. ![image](https://forum-cdn.hhf.technology/original/1X/1d1a90fed929e48cbde3f345573f53498cf5f73c.png) Please be reminded to restart Jellyfin after installing the plugin. ### Setting up LDAP Authentication Jellyfin Plugin Set the following configuration parameters for LDAP Server Settings section - LDAP Server: DuoAuthProxy - LDAP Port: 1812 - Secure LDAP: unchecked - StartTLS: unchecked - Skip SSL/TLS Verification: checked - Allow Password Change: (optional, but ensure the service account have the lldap\_password\_manager group if checked) - LDAP Bind User: uid=svc-duoauthproxy,ou=people,dc=example,dc=com - LDAP Bind User Password: password - LDAP Base DN for searches: ou=people,dc=example,dc=com At this point click `Save and Test LDAP Server Settings` to test connectivity, it should pass if all your settings are good. Set the following configuration parameters for LDAP User Settings section - LDAP Search Filter: (uid=\*) - LDAP Search Attributes: uid, mail - LDAP Uid Attribute: uid - LDAP Username Attribute: uid - LDAP Password Attribute: userPassword - LDAP Admin Filter: (memberof=cn=lldap\_admin,ou=example,dc=com) Note you should change your LDAP Search Filter and LDAP Admin Filter according to your needs, reference: [https://github.com/lldap/lldap/blob/main/example\_configs/jellyfin.md](https://github.com/lldap/lldap/blob/main/example_configs/jellyfin.md) At this point click `Save and Test LDAP Filter Settings` and check if there are more than 0 users and admins found, it should if all your settings are good. Afterwhich, enter `admin` in `Test Login Name` field and `Save Search Attribute Settings and Query User` button to do a final lookup check and save. Finally, configure Jellyfin User Settings sections to your needs and don’t forget to hit the big blue `Save` button. ### (If Jellyfin has existing users) Switch users’ Authentication Provider to LDAP-Authentication ![image](https://forum-cdn.hhf.technology/original/1X/706f5087d79c8a37c5375c1dcebaed0f0940d3d6.png) ### Test the new authentication flow The new authentication flow should be immediately active, you can log out and test it. If not, you can try another restart of Jellyfin first. ## Afterword Of course, this guide will not be a one-size fit all like the Authentik solution was for me. A lot of settings can and should be customized to your needs. This guide only follows through the most basic setup.