sso-and-identity: verify against live-checked KB, expand real depth, add evidence

Browse Source

Source Trilium notes (Authentik/SSO Integration, Gitea Access Model)
live-verified and stamped this session - authentik_api_token confirmed
in vault.yml, automation-bot confirmed as a real non-admin Gitea account
via the API.

Cut the redundant Mermaid diagram (prose right below it said the same
thing). Restored the LDAP/superuser-outpost exception from the source
note as a compact callout rather than a full section, proportionate to
its actual weight. Added the real reasoning for centralizing auth and
the proxy-layer defense-in-depth argument, a table of the ~9 apps
running real native OIDC/SAML on top of the universal Proxy Provider
baseline (corrected after initially misstating it as either/or), the
provider-removal discipline, and two screenshots proving the Write/
Read-only access split instead of just asserting it.

...

This commit is contained in:

thesabear committed 2026-08-26 11:54:29 +03:00

1 parent f1d1464af5

commit 3e91e426d1

3 files changed

+31 -8

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

assets/gitea-collaborators-automation-bot.png

BIN

Binary file not shown.

Side by Side After Width:  |  Height:  |  Size: 66 KiB