apo reads the wiki now. Checking every other configured user turned up the bigger
finding: Authentik has a group wiki-zugang with four members, and Wiki.js does not
honour it. Groups map by name, and the wiki only knows wiki-anwender and authentik
Admins - so elbojoloco, clark and Boje hold membership that does nothing, while the
name promises the opposite. Nobody noticed because none of them ever attempted a
login; Wiki.js has exactly two OIDC users.
The reason is a leftover: two Authentik applications share the display name
"ThreadNet Wiki". The one carrying the wiki-zugang policy has no provider at all -
an empty shell from the Docusaurus forward-auth era that ADR-0014 retired. The live
wiki-js application carries no policy binding, so it is open to any authenticated
user and the whole separation rests on a group assignment nobody looks for there.
So the trap cuts both ways: granting wiki-zugang grants nothing, and the real
application is ungated at its own layer. Acceptance now also covers retiring the
dead shell, resolving wiki-zugang, and the two empty leftover groups.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Thore CimbalandClaude Opus 5
8ca8a97a06