i ended up doing both. ldap for the apps. oidc for web based users and the apps that support the quick connect feature. the local user account system works fine too, and ldap would be enough. i just wanted an excuse to play round with sso systems, and it was fun figuring out how to connect all my servers.

authenik has a good docs site for both it’s docker container and connecting it to jellyfin. Authelia looked interesting too.