Authentik handles SSO for all my apps like immich, linkwarden, owncloud etc. Openid when available but some web apps are done via forward proxy auth. Jellyfin uses LDAP via authentik which isn't sso technically.
Other than me, no one else mounts samba shares directly. All personal files are synced to server and other devices with owncloud (OCIS).