Your server
Three ways in, and you decide which apply.
A password, the media server account, or a sign-in service you already run: Nexview can do all three at once, and a new way never takes an old one away by itself. If you want to keep your password, you keep it. Only once a provider is running can you switch the password off, and the operator can always get in with it.
The overview
You decide what the sign-in page shows.
Out of the box there is exactly one field for the user name and one for the password. Everything else appears only once you set it up. If nothing is set up, the page looks as it always did.
If a media server is connected, a button “Sign in with Plex” joins in, or Jellyfin, or Emby. If sign-in services are entered, each provider adds another button, with the name you gave it.
Every one of these ways leads into the same account. Role, quota, approvals and history hang on the Nexview account, not on the way in.
Password
The way that is always there.
Accounts come by invitation
The administrator sets only the address and the role. The invitee picks their own user name, display name and password through the link in the mail. Nobody else learns that password, not even the administrator.
The address has to be confirmed
Without a confirmed address no account gets in with a password. If the confirmation mail never arrived, the sign-in page offers “Resend confirmation mail” and “Correct address” once you enter the right password, so a typo is not final. The account from the setup assistant counts as confirmed at once.
A brake against guessing
After a few wrong passwords Nexview slows the next attempt down, and after ten it closes the door for fifteen minutes. It opens again by itself. Counting happens per account, and if you set NEXVIEW_CLIENT_IP you get a count per address as well.
Good to knowIf you say “direct” for NEXVIEW_CLIENT_IP while a proxy sits in front, every request looks as if it comes from the same address, and one typo locks out the whole household. When in doubt, leave the variable unset. That is always safe.
OpenID Connect
authentik, Entra ID, Keycloak, Google, or whatever else you run.
OpenID Connect is a standard, and that is why there is no list of supported providers here. From Nexview's point of view a provider is an address, a client ID and a secret. Whether authentik, Microsoft Entra ID, Keycloak, Authelia, Pocket ID, Zitadel or Google stands behind it makes no difference. Several providers at once work, one button each, in an order you drag. You set it up under Settings › System › Sign-in in three cards: Sign-in, Sign-in providers and authentik in one step.
authentik in one step
Enter authentik's address and an API token and press “Set up”. Nexview creates provider and application there itself and fills in everything. Every step is listed with a tick or a cross, and the token is not stored. If you would rather apply it yourself, use “Download blueprint instead”.
Microsoft Entra ID
With the tenant ID for your own tenant, or with common or organizations for several. Nexview then accepts a token from any tenant whose issuer and tenant ID agree. Entra accepts only https as a redirect address, localhost aside.
By hand
“Add a provider” asks for the name on the button, a short name, the issuer, client ID and secret. You do not enter the single endpoints, Nexview reads them at /.well-known/openid-configuration and checks them before anything is saved. It asks for openid email profile, nothing more.
What your provider needs from you is the redirect address. Nexview builds it from your public address and shows it ready to copy before you save:
https://nexview.example.com/api/oidc/<short name>/callbackGood to knowThe public address has to be right beforehand. A provider rejects any redirect address that is not registered with it exactly. If Nexview runs under a sub-path, the sub-path is part of it. If the public address changes later, Nexview asks first when a provider knows the old one. Behind a proxy that ends TLS, add NEXVIEW_CLIENT_IP=proxy, so Nexview also reads X-Forwarded-Proto and the redirect address starts with https.
Accounts
Link instead of guess, and two switches worth understanding.
Nexview recognises a person only by their identity at the provider, never by the e-mail address, even when the provider says it is confirmed. If somebody changes their name or address at the provider, the link holds.
How somebody gets in
- Existing accounts link themselves, under Profile › Account › Security at “Sign-in providers”. “Link” asks for your own password once more, then goes to the provider and back. Afterwards both work: the provider's button and still your password. “Unlink” removes the link again.
- Invited people pick “Continue with …” on the invitation page instead of a password. The invitation travels to the provider and back and is used up exactly once.
- Everybody else gets in only if “New people get an account” is on for that provider. Otherwise the sign-in page says an invitation is needed, or that the account can be linked in the profile.
Two switches
- “New people get an account” is off out of the box. With Google and Microsoft, “create automatically” literally means every person with an account there. These providers hand out an e-mail address to half the world. Switch it on only if you decide who has an account at the provider, or if you have limited the application there to your own organisation. Nexview writes exactly that next to the switch.
- “On” takes a provider off the sign-in page without throwing the setup away. That is the right move when something at the provider is being rebuilt. A single identity can also be blocked without switching off the whole provider.
Nexview does not read the provider's groups. The provider says who somebody is. What they may do, that is role, quotas, blocked quality profiles and auto-approval, stays in Nexview. When an account is deleted, Nexview blocks its identity so that “New people get an account” does not let the same person straight back in. The block list sits under the three cards, and “Lift block” lets the identity in again. Administrators see each account's providers as small marks under “Settings › Users” and can unlink one there, with their own password.
The other way
With the media server account.
Whoever already runs a media server has the accounts there and does not have to create them a second time in Nexview. Plex, Jellyfin and Emby all work, even at the same time. Matching happens only to an address that is confirmed in Nexview or set by the operator, and an address taken over from the provider does not count.
The link brings more than a sign-in: Nexview uses it to recognise what is already in your library and who has already watched which title. It is covered in detail on the Media server page.
What is checked
When a sign-in is refused.
What Nexview checks
On the provider's token: the signature against the provider's published keys (never a shared secret), issuer, audience, expiry, the nonce and a non-empty subject. On the attempt itself: PKCE, a state that is used once, and a short-lived cookie with a key of its own.
Where the reason is
Every refused sign-in leaves a line with the reason under Settings › System › Log. Addresses appear shortened, tokens and secrets never. Whoever tried to sign in gets a short sentence that says what to do.
Good to knowIf a provider fails, the operator is not shut out: they can always get in with the password, through “Sign in as the operator with a password”. If the last provider goes or is switched off, passwords work again for everyone. If the operator is locked out themselves, the emergency exit NEXVIEW_BETREIBER helps: with your user name and a restart of the container, that user carries the owner flag again. Remove the line afterwards.
To be honest
What sign-in cannot do.
What somebody may do in Nexview is not read from the provider's groups. You set role and quotas in Nexview.
Nexview has no second factor of its own. If you want one, switch it on at the provider and use its sign-in.
Even a confirmed address does not turn an identity into an existing account. Whoever wants to sign in that way links once in the profile or comes with an invitation.
Exactly one account owns the installation. No other administrator can switch it off, delete it, demote it or set its password. Only the holder can hand it on.