Support #387
Updated by Charles N 1 day ago
Parent/umbrella: #311 (OAM - Security Hardening Auditing and Compliance). Eliminate local non-root accounts by routing all system authentication through Cloudron as the identity provider using OIDC. ## Scope - [ ] Configure Cloudron as OIDC identity provider - [ ] Integrate OIDC auth for system login (SSH, Cockpit, Webmin) - [ ] Map Cloudron groups/roles to system access - [ ] Remove local non-root accounts - [ ] Validate in sectestbed-* before prod ## Context - Cloudron does NOT support LDAP for system login (LDAP is app-only). - OIDC is the supported path for SSO. - Roles executed via tsys-awx (AWX). ## Dependencies Depends on #379 #1 (test lab). **Blocks** #388 #10 (patch management), #390 #12 (MDM).