mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-09 20:26:33 +00:00
SSO_SERVICE_ENABLED read lookup('service', 'sso').required, which is true whenever any role in the round pulls in Keycloak. Variants 2 and 3 set services.sso.enabled: false, so the OIDC plugin is never installed, yet the flag still told _shared.js to take the OIDC branch of wpAdminLogin; it landed on /wp-login.php and nothing redirected.
Every other *_SERVICE_ENABLED key in the template already resolves through the role's own config. LDAP_SERVICE_ENABLED keeps the round-wide lookup because the role declares no ldap entry in meta/services.yml.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>