Decision sorb. elbojoloco joins apo in wiki-anwender, so both read /anwender and
the start page while betrieb/* stays closed. Recorded because the addendum's table
would otherwise still list the account as having no effect.
The grant takes hold at the next login - the groups claim is minted during sign-in,
not continuously - and elbojoloco has never signed in to the wiki, so the account
gets created and mapped on first attempt.
Boje is still undecided, and clark and lucky remain test accounts slated for
deletion in #0074. The silent dead end persists for them, which is why the grants
do not close this issue.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
apo reads the wiki now. Checking every other configured user turned up the bigger
finding: Authentik has a group wiki-zugang with four members, and Wiki.js does not
honour it. Groups map by name, and the wiki only knows wiki-anwender and authentik
Admins - so elbojoloco, clark and Boje hold membership that does nothing, while the
name promises the opposite. Nobody noticed because none of them ever attempted a
login; Wiki.js has exactly two OIDC users.
The reason is a leftover: two Authentik applications share the display name
"ThreadNet Wiki". The one carrying the wiki-zugang policy has no provider at all -
an empty shell from the Docusaurus forward-auth era that ADR-0014 retired. The live
wiki-js application carries no policy binding, so it is open to any authenticated
user and the whole separation rests on a group assignment nobody looks for there.
So the trap cuts both ways: granting wiki-zugang grants nothing, and the real
application is ungated at its own layer. Acceptance now also covers retiring the
dead shell, resolving wiki-zugang, and the two empty leftover groups.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Decision sorb, after diagnosing why @apo could not reach the wiki. apo logs in
fine; the account exists since 2026-08-16 and was used again today. It is in no
group, and wiki-anwender has zero members, so the wiki is effectively admin-only
and every non-admin who ever tried met the same wall.
Three deliberate settings compose into a dead end: OIDC self-registration creates
the account, autoEnrollGroups is empty so it gets no group, and Guests was stripped
to no permissions while the only rule for home belongs to wiki-anwender. Default
deny then applies to every path including the start page - the user sees nothing
rather than a reason, and at the current log level nothing records the attempt
either. Same class as the mrtc outage: healthy, green, unusable, silent.
The issue asks for a decision rather than assuming one: auto-enroll into
wiki-anwender (the population is already curated by the invitation token, and
betrieb/* stays admin-only through default deny), or keep per-person curation and
make the dead end speak. Acceptance is a real login, not a config diff.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Thore CimbalandClaude Opus 5