🛠️ Management
System Management
- User Lifecycle: Provisioning, deactivation, and roles.
- Authentication: Native Authelia OpenID Connect (Other), with existing local email/username password access retained. See Native Authelia SSO for the deployed configuration and proof.
- Compliance: Data retention, export, and compliance exports.
- Monitoring: Performance metrics, server logs, and health checks.
- Updates: Upgrading the Mattermost server.
Verified identity boundary
The 2026-09-28 read-only check confirmed that the existing native pxl account remains an ordinary system_user, with authentication service openid; no Authelia group-to-administrator mapping is configured. All four original accounts retain their identity fields and roles. The historical zero-team landing page was authenticated onboarding, not a request for a second login. At 22:18:57.679 UTC that day, the parent’s retained-session reload/readback again returned the same native pxl account, global system_user role, and openid service alongside the real test post.
Native application logout revokes the current Mattermost session, but an active Authelia session can sign the user back in through normal entry. Use the explicit local-login escape when automatic entry must stop. No global single-logout claim is made.
Under D-190 amendment 2, retain the enabled native provider, existing client, and native-entry routing. The amendment-1 application rollback was never activated and is now superseded. Do not apply its staged environment or Compose restoration. The parent created team D190 SSO Test (ID u1hm1obw7fnu9k3nsmcoymfz1w, actual slug d190-sso-ted190-ssosync-aedc8b8ast, allow_open_invite=false), private channel ssosync-test (ID oq1dd6ow43n1bjhyx749sp1jao, type P), and one real post jgrwwfssup8y8p9em8k4gayk3r, authored by native pxl (sm9fczhfbty97m677mmhh18bnh). Its exact text is D190-SSOSYNC-aedc8b8a: pxl native Authelia SSO test message. Team/channel administration is creator-scoped only; the global role remains system_user. No users were invited and no global administrator grant, temporary user, password reset, Authelia user write, or licensing change was used.
The earlier loca limitation is historical: there was no existing Mattermost account to link, and its own first native login was not verified. Amendment 2 uses the already-created pxl identity. The real message and persistence were proven using its retained native application session, without a new IdP submission for that proof. The original shared IdP session was observed no longer active when the first-factor form appeared at 04:33 UTC on 2026-09-28, before this message proof; no new submission occurred then and the cause was not established. Gatekeeper batch 3 is recorded APPLIED on 2026-09-28 (Authelia restart 22:57:32 UTC, healthy 22:57:35 UTC; nginx reload 22:57:41 UTC). The authorized final additional pxl first-factor submission completed at 2026-09-29T07:19:22.199Z with HTTP 200, landing at WCHT / with native identity HTTP 200 for pxl. Separate final Mattermost native readback at 07:23:02.613 UTC returned HTTP 200 for the same pxl / system_user / openid identity and existing post jgrwwfssup8y8p9em8k4gayk3r; no additional password or duplicate message was needed. The dated batch receipt does not establish current live Authelia configuration parity. Most acceptance is supported and these sources have been published; overall mission status remains BLOCKED / partial success on separate Chat/Rocket/Team blockers. See the dated proof for timestamps and screenshots.