k.rennerandClaude Opus 4.7
e563cbfecd
Live binds from nas-1 land in the Jellyfin Application's policy evaluation because the outpost dispatches by base_dn suffix match — with LDAP Unifi/Jellyfin/Synology all sharing DC=authentik,DC=renner, DC=uno, the alphabetically-first provider wins every request. Moving Synology under DC=synology,DC=authentik,DC=renner,DC=uno gives the outpost a unique suffix to route on. Unifi/Jellyfin are left alone; neither is LAN-reachable yet so the duplicate-base-DN there is dormant config, not in this change's scope. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>