Authentik handles SSO for all my apps like immich, linkwarden, owncloud etc. Jellyfin uses LDAP via authentik but isn’t sso.

Other than me, no one else mounts samba shares directly. All personal files are synced to server and other devices with owncloud (OCIS).