"Enable Authorization by Plugin: false" should be able to create users with no permissions

[mardom1]

Describe the bug
Even though both "Enable Authorization by Plugin" and "Enable All Folders" are disabled, a new user is created with access to all libraries. The help text below "Enable Authorization by Plugin" states however, that "If false, the user will start with no permissions and an administrator will add permissions".

When I enable "Enable Authorization by Plugin" and leave "Enable All Folders" disabled, the new user has no permissions as expected. After giving access to a library, and logging out and back in, the library access is gone again, even though the help text says "The permissions of existing users will not be rewritten on subsequent logins".

To Reproduce
Issue:

1. Disable both options in the plugin settings.
2. Login with SSO (new user)
3. New user gets created with access to all libraries

Issue 2:

1. Enable "Enable Authorization by Plugin", disable "Enable All Folders"
2. Login with SSO (new user)
3. See that new user has no permissions
4. Give user permission to a library
5. Refresh and see that user now has permissions
6. Logout and sign-in again using SSO
7. User has no permissions again

Expected behavior
Behavior according to help text. No permissions when both option are disabled. When "Enable Authorization by Plugin" is enabled, do not overwrite permissions after each login.

Screenshots
Not needed.

Configuration
According to description.

Versions (please complete the following information):

• OS: Linux
• Browser: chrome
• Jellyfin Version: 10.8.10
• Plugin Version: 3.5.2.0

[9p4]

I think that the docs are unclear. The permissions will always be overridden on login (this is intended) if "Enable Authorization by Plugin" is enabled. If it is disabled, it will not modify any permissions for any user, and instead use the Jellyfin defaults (all access all the time).

Thank you for bringing the documentation issue to light.

[mardom1]

Ah, ok. That makes sense if permissions are given through SSO.

Would it be possible to add an option to auto-create users without any permissions, but still keep access management in Jellyfin? Nothing important, though.

[9p4]

Related: #111

[brilthor]

This is a pretty big deal for attaching to google for auth, unless I'm missing something if you setup google for auth anyone with a google account can then login and will default have access to all the media.

I know with gitlab users get created when they login but are disabled until an admin enables them