claude-botandClaude Opus 5.5
67a1eb2ba5
Stage 2 of unifying the auth flows, after the llama and paperless trial of stage 1 was confirmed: - Brand authentik.srv.renner.uno: flow_authentication = sso-authentication (was NULL, i.e. the slug-first default-authentication-flow with password + MFA). Every provider without its own authentication_flow logs in through it, PVE and PBS included. - The 7 blueprint OIDC providers (Home Assistant, NetBird, Audiobookshelf, Immich, Gitea, Grafana, Matrix MAS): authentication flow unset (brand), authorization implicit consent. - authentik-gate-sync: default authorization flow implicit consent, via DEFAULT_AUTHORIZATION_FLOW on the Deployment and in the code; the per-gate login/authorization annotations are dropped. Paperless keeps paperless-authorization. Every flow referenced here already exists, so the gate controller does not hit the missing-flow removal seen in stage 1. Stage 3 removes the passkey-only flows once nothing references them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>