Fixed auth flow for KEYWARDEN_AUTH_MODE, native; oidc; hybrid work as intended. no login page for OIDC mode, assumes internal IdP for now. will fix when social login implemented

.env.example

@@ -19,9 +19,9 @@ KEYWARDEN_ADMIN_EMAIL=admin@example.com
 KEYWARDEN_ADMIN_PASSWORD=password
 
 # Auth mode: native | oidc | hybrid
-# native: Uses JWT authentication based on Username / Password
-# oidc: Disables in-build auth, exclusively uses OIDC configuration
-# hybrid: Allows native auth, prefers oidc
+# native: Uses Keywarden username/password login only. OIDC/social options are hidden and disabled.
+# oidc: Disables built-in login and uses OIDC only. Users can be auto-onboarded from IdP claims.
+# hybrid: Supports OIDC + Keywarden native login; login screen prefers OIDC/social options first.
 
 KEYWARDEN_AUTH_MODE=native
 
@@ -41,14 +41,16 @@ KEYWARDEN_AUTH_MODE=native
 # KEYWARDEN_OIDC_EMAIL_CLAIM=email
 # KEYWARDEN_OIDC_EMAIL_VERIFIED_CLAIM=email_verified
 # KEYWARDEN_OIDC_USERNAME_CLAIM=preferred_username
+# KEYWARDEN_OIDC_ALLOW_AUTO_ONBOARDING=true
 # KEYWARDEN_OIDC_GROUPS_CLAIM=groups
-# KEYWARDEN_OIDC_SYNC_ADMIN_FROM_GROUPS=false
+# KEYWARDEN_OIDC_SYNC_ADMIN_FROM_GROUPS=true # defaults to true when KEYWARDEN_AUTH_MODE=oidc
 # KEYWARDEN_OIDC_ADMIN_GROUPS=authentik Admins
 # KEYWARDEN_OIDC_ADMIN_DEMOTE_ON_MISS=false
 
 # Social login (optional)
 # KEYWARDEN_SITE_ID=1
 # KEYWARDEN_SOCIAL_REQUIRE_VERIFIED_EMAIL=true
+# KEYWARDEN_SOCIAL_ALLOW_AUTO_ONBOARDING=false
 # KEYWARDEN_SOCIAL_GOOGLE_ENABLED=false
 # KEYWARDEN_SOCIAL_GOOGLE_CLIENT_ID=
 # KEYWARDEN_SOCIAL_GOOGLE_CLIENT_SECRET=
@@ -61,4 +63,4 @@ KEYWARDEN_AUTH_MODE=native
 
 # Authentik Secrets
 AUTHENTIK_PG_PASS=
-AUTHENTIK_SECRET_KEY=
+AUTHENTIK_SECRET_KEY=