Complete identity seams and email login

sso-mfa/k8s/authelia/configmap.yaml

@@ -50,7 +50,10 @@ data:
         base_dn: dc=netkingdom,dc=local
         username_attribute: uid
         additional_users_dn: ou=people
-        users_filter: "(&({username_attribute}={input})(objectClass=inetOrgPerson))"
+        # Accept either the stable uid or the user's mail address. Authelia's
+        # official LLDAP integration recommends this OR filter; the resolved
+        # identity still uses uid as its stable username.
+        users_filter: "(&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=inetOrgPerson))"
         additional_groups_dn: ou=groups
         groups_filter: "(member={dn})"
         group_name_attribute: cn