- SSO_* settings (login only, master password still decrypts the vault) - optional authentik blueprint: provider with authorization_code/refresh_token grants, application and an email mapping with email_verified, which vaultwarden requires to link SSO logins to existing accounts - blueprints are copied into the authentik container, it only applies files from /blueprints Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>