I use Traefik and Oauth to implement two-factor authentication with single sign-on via Google. Works fine if you don’t mind the requirement that all your users must have a gmail account with Google.

How would that work with a Jellyfin client running on a device like a Chromecast dongle? The code on the dongle doesn’t (IMHO) know how to log into an SSO service.