Add OpenID Connect SSO with optional authentik blueprint

- SSO_* settings (login only, master password still decrypts the vault)
- optional authentik blueprint: provider with authorization_code/refresh_token grants, application and an email mapping with email_verified, which vaultwarden requires to link SSO logins to existing accounts
- blueprints are copied into the authentik container, it only applies files from /blueprints

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

defaults/main.yml

@@ -34,3 +34,22 @@ vaultwarden_smtp_user: user@my-domain.tld
 vaultwarden_smtp_pass: ThisCouldBeYourAdd
 
 vaultwarden_loglevel: warn
+
+#OpenID Connect single sign on (login only; the master password still decrypts the vault)
+vaultwarden_sso_enabled: false
+vaultwarden_sso_only: false
+vaultwarden_sso_signups_match_email: true
+vaultwarden_sso_authority: "https://idp.{{ domain_external }}/application/o/{{ vaultwarden_sso_slug }}/"
+vaultwarden_sso_scopes: "email profile offline_access"
+vaultwarden_sso_client_id: vaultwarden
+vaultwarden_sso_client_secret: SSOClientSecret
+
+#create provider + application in a local authentik through a blueprint
+vaultwarden_sso_authentik: false
+vaultwarden_sso_slug: vaultwarden
+vaultwarden_sso_name: Vaultwarden
+vaultwarden_sso_authentik_data: "{{ cloud_apps }}/authentik/inst/data"
+vaultwarden_sso_authentik_container: inst-worker-1
+vaultwarden_sso_authentik_signing_key: "authentik Self-signed Certificate"
+vaultwarden_sso_authentik_authorization_flow: default-provider-authorization-implicit-consent
+vaultwarden_sso_authentik_invalidation_flow: default-provider-invalidation-flow