[Plugin] Seerr integration lacks Quick Connect login option for SSO-only Jellyfin users

[DrPleb]

Plugin version

2.0.3.0

Server type and version

Jellyfin 10.11.11

Area

Seerr integration

What happened

A Jellyfin user that only ever authenticated via OIDC/SSO (jellyfin-plugin-sso,
SSO-Only mode: DisablePasswordLogin=true, no native Jellyfin password at all
except a break-glass admin account) logs into Jellyfin fine, but inside the
Moonfin app's Seerr-connect screen is only offered two login methods:

• "Jellyfin Account" (username + password) - fails. The user has no native
  Jellyfin password, and DisablePasswordLogin blocks Seerr's server-side
  mediaServerLogin credential check as well, not just the interactive
  Jellyfin login form - so this path is dead for every user on the server,
  not just this one.
• "Local Account" (Seerr email + password) - works, but requires an admin
  to manually create/patch a local Seerr account + password for every
  single SSO-only user. Doesn't scale, and reintroduces a stored password
  the whole point of SSO was to avoid.

Users migrated to SSO after already having a working native Jellyfin
password still work fine in Moonfin's Seerr integration - but only because
Moonfin's saved Seerr session predates the switch to SSO-Only and is just
being reused from cache (SaveSessionAsync/LoadSessionAsync), never
re-validated against a live Jellyfin password check. A brand-new pure-SSO
user has no such cached session and hits a hard wall.

Seerr itself already has a full native Jellyfin Quick Connect login flow
that needs no OIDC support on Seerr's side at all:

POST /auth/jellyfin/quickconnect/initiate
GET /auth/jellyfin/quickconnect/check
POST /auth/jellyfin/quickconnect/authenticate

(see seerr-api.yml, tag "auth")

And the Moonfin server plugin itself already contains matching scaffolding -
confirmed via strings on Moonfin.Server.dll (Moonbase 2.0.3.0):

Moonfin.Server.Api.SeerrProxyController
- Login
- LoginWithQuickConnect <- present, routed, but not surfaced in any
client UI I've tried
Moonfin.Server.Services.SeerrSessionService
- AuthenticateAsync
- AuthenticateViaQuickConnectAsync
- GetSessionAsync / ValidateSessionAsync / SaveSessionAsync /
LoadSessionAsync / CheckForRotatedCookieAsync

with direct references to MediaBrowser.Controller.QuickConnect / IQuickConnect
in the same code path. So this looks like unfinished wiring rather than a
missing feature: the server-side pieces to drive Seerr's own Quick Connect
flow appear to already exist, they're just not exposed as a login option on
the Seerr-connect screen.

Related: #92, where the maintainer's only suggested fix for this exact
scenario is manually setting a password - which is what prompted me to dig
into why Quick Connect isn't offered there, since Moonfin already uses Quick
Connect for the primary Jellyfin login on the same app.

Steps to reproduce

1. Run Jellyfin with jellyfin-plugin-sso in SSO-Only mode (DisablePasswordLogin
   = true), so provisioned users have no native password.
2. Create a brand-new user purely through the OIDC provider (no prior Jellyfin
   account, no password ever set) and let them log into Jellyfin/Jellyseerr
   once so the Seerr account gets auto-provisioned and linked via jellyfinUserId.
3. Open the Moonfin app (tested on iOS and Android TV) as that user, go to the screen where it asks to
   connect/authenticate to Seerr.
4. Observe only "Jellyfin Account" and "Local Account" are offered - no
   Quick Connect option, despite the same app using Quick Connect for the
   primary Jellyfin login moments earlier.
5. "Jellyfin Account" fails with Unauthorized / "please enter your password".
   The only way through is switching Seerr to allow local logins and manually
   creating a local password for the user.

Frequency

Always

Screenshot of the problem

No server-side error/exception to attach for this one: it's not a runtime
failure, it's a missing UI option, so the Jellyfin server log for this
session is clean aside from the expected "please enter your password"
rejection when Jellyfin Account is attempted with no password set.

Server logs / errors (optional)

[2026-08-19 10:22:57.257 +02:00] [WRN] [44] Moonfin.Server.Services.SeerrSessionService: Seerr auth failed for user "testuser": Unauthorized - "{\"message\":\"INVALID_CREDENTIALS\"}"
[2026-08-19 10:23:04.068 +02:00] [WRN] [52] Moonfin.Server.Services.SeerrSessionService: Seerr auth failed for user "testuser": Unauthorized - "{\"message\":\"INVALID_CREDENTIALS\"}"

-- above: two attempts via "Jellyfin Account" (username + password), both rejected
because the user has no native Jellyfin password (DisablePasswordLogin=true in
jellyfin-plugin-sso blocks the credential check server-side, not just the UI form).

[2026-08-19 10:30:04.530 +02:00] [INF] [41] Moonfin.Server.Services.SeerrSessionService: Seerr SSO session created for user "testuser@service.local" (Jellyfin: 04dc3f74-e092-42fa-a2b5-3be607bf1234)

-- above: only succeeded once we switched to "Local Account" and manually created a
Seerr-local email+password for this user. Note the log line itself calls this a
"SSO session" even though it was created via a local-account credential check -
suggesting any session tied to a jellyfinUserId is already treated internally as
equivalent to an SSO session, once it exists.

[github-actions]

Thanks for the report, @DrPleb.

Before anyone can pick this up it needs a little more from you, so it has been labelled Missing Screenshot.

A screenshot is missing

The plugin keeps no diagnostic log of its own, so a picture of what you're seeing is the fastest way to make a report actionable.

Drag a screenshot straight into a comment below, showing the plugin config page, the client screen, or whatever is wrong. For a sync problem, the same setting on each client side by side is what makes it obvious.

• Windows: Win + Shift + S
• macOS: Cmd + Shift + 4
• Linux: PrtSc, or your desktop screenshot tool

It's also worth pasting anything the server logged. Open the Logs page in your Jellyfin or Emby dashboard and search for Moonfin, which is the name the plugin logs under.

Each label comes off automatically once that piece is sorted.

[RadicalMuffinMan]

Thanks for the detailed write up. The endpoint trace saved me a lot of time.

One correction though. The Quick Connect path is not unfinished. It's wired on both sides and shipped a while ago. It just runs silently instead of appearing as a login option, which is why strings showed you the methods but the screen showed you nothing.

The plugin drives the exact flow you found. AuthenticateViaQuickConnectAsync posts to /api/v1/auth/jellyfin/quickconnect/initiate, takes the code and secret it gets back, approves the code itself through Jellyfin's IQuickConnect.AuthorizeRequest, then posts the secret to /api/v1/auth/jellyfin/quickconnect/authenticate. It skips the /check polling because it authorizes on your behalf rather than waiting for someone to type a code in.

On the client, Moonfin calls that bridge automatically whenever you signed in without a password, which is exactly the SSO only case. It retries across roughly the first 20 seconds after login so a server that is slow to come up still recovers. That landed in Moonfin 2.3.1 on 23 July.

Why you're probably not getting it:

There are two version floors here, and your report doesn't tell me either one.

• The Moonfin app needs to be 2.3.1 or newer.
• Seerr needs the Quick Connect endpoints from feat: add jellyfin/emby quick connect authentication seerr-team/seerr#2212, which merged on 3 July.

If your Seerr predates that PR then initiate returns 404, the plugin answers sso_unsupported, and the client stops trying for the rest of that run. That branch returns without logging anything, which fits what you attached. Every line you posted comes from the password path, and there is no "Seerr Quick Connect initiate failed" warning, which is what any other kind of failure would have written.

So could you tell me two things:

• the Moonfin app version on the iOS or Android TV device
• your Seerr version

[DrPleb]

Thanks for the fast and detailed explanation — that clears up a lot, and the
"stops trying for the rest of that run" detail turned out to be the key to
finding what was actually happening.

Versions:

• Moonfin app: 2.4.0 (iOS)
• Seerr: 3.4.1

Both floors are met on my end — I confirmed Seerr's Quick Connect endpoints
are live (POST /api/v1/auth/jellyfin/quickconnect/initiate returns 200, not
404) — so the version-mismatch explanation doesn't apply to my case. Digging
further with that in mind, I think I found the actual trigger: a race
condition between Seerr's just-in-time user provisioning and Moonfin's single
early Quick Connect attempt.

I run a companion plugin (Jellyfin Enhanced) that auto-imports a user into
Seerr on first use, asynchronously, the first time anything touches that
user's Seerr access. It's not instant — in my server log it consistently
takes 2-3 seconds after Jellyfin login to complete. For the user who
originally hit this bug, Moonfin's automatic Quick Connect attempt almost
certainly ran before that import had finished, got nothing valid to
authenticate against, and then - per what you described - never tried again
for that app run. From then on the only options visible were "Jellyfin
Account" / "Local Account", both dead ends for an SSO-only user with no
native password.

I reproduced the difference with a clean test user today. Full timeline from
the server log:

09:34:56.7 SSO login succeeds, Jellyfin user provisioned
09:34:58.9 Jellyfin Enhanced starts the Seerr just-in-time import
09:34:59.4 Seerr account confirmed provisioned (Seerr user 17)
09:35:45.8 Moonfin opens a session toward Seerr
09:35:45.9 "Seerr Quick Connect session created for Jellyfin user ... (Seerr
user 17)" - success

This time it worked, but only because ~49 seconds passed between login and
opening the Moonfin app (I was mid-setup on the Jellyfin web UI in between) -
comfortably past both the Seerr import and, I'd guess, past your ~20s
Quick Connect retry window too. With the original user, that gap was much
shorter, and it landed in the failure window.

So the underlying issue seems to be: Moonfin's Quick Connect attempt has no
way to know whether the Seerr-side account is actually ready yet, and if it
isn't, that one shot is spent for the whole app run. A same-server companion
plugin doing async Seerr provisioning isn't a rare setup, so this seems worth
handling on the Moonfin side - a couple of ideas, in case either is easy to
land:

• extend the retry window past ~20s (or make it configurable), or
• add a second trigger point - e.g. retry once when the user actually
  navigates to the Seerr screen, not only right after login - so a slow
  Seerr-side account doesn't permanently lock out that session.

Happy to test a build or provide more logs if useful.