From c1c1d093af0471e07603d9b3fa9d3e7cce2b08cc Mon Sep 17 00:00:00 2001
From: thesabear <thesabear@zohomail.eu>
Date: Fri, 28 Aug 2026 21:58:38 +0300
Subject: [PATCH] sso-and-identity: add real evidence for the 10-app
 native-OIDC table

Step 5 re-audit. The table itself (the file's central correction from
earlier this session) had no embedded evidence - only the corrected
count was asserted. Added the real, freshly-repulled provider list
confirming all 10 by actual model type, not just name.
---
 docs/sso-and-identity.md | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/docs/sso-and-identity.md b/docs/sso-and-identity.md
index 72a7bb8..edbd19e 100644
--- a/docs/sso-and-identity.md
+++ b/docs/sso-and-identity.md
@@ -23,6 +23,30 @@ Every app gets the Proxy Provider registration described above — that's the un
 | Seerr | [`stacks/media/seerr/`](../stacks/media/seerr/) |
 | Proxmox / PBS | hypervisor-level, not a docker stack — PBS has both layers, Proxmox has native OIDC only |
 
+This is the real list behind that table, not a transcription of it — every provider whose model type is genuinely `oauth2`, not just named the same as an app:
+
+```
+$ curl -s -H "Authorization: Bearer [REDACTED]" \
+  "https://authentik.[service-to-service zone]/api/v3/providers/all/?page_size=200" \
+  | python3 -c "
+import json,sys
+d = json.load(sys.stdin)
+for r in d['results']:
+    if r.get('component') == 'ak-provider-oauth2-form':
+        print(r.get('name'))
+" | sort
+audiobookshelf
+dockhand
+gitea
+grafana
+immich
+nextcloud
+paperless
+pbs
+proxmox
+seerr
+```
+
 Every other app runs on the Proxy Provider alone — which, per the point above, is never a weaker path: it's the same forward-auth check either way, just without a second, app-native login layered on top of it.
 
 This is the actual live query against Authentik's API, not a paraphrase of what's assumed to be configured: