Send a direct Authelia sign-in to the account site.

A visit to the sign-in portal with no follow-up now continues to
https://users.coulomb.social. A provided follow-up still wins. The
success screen cannot carry a custom link.

Assistant: grok
Assistant-Session: 01a0d25d-d358-7e13-b84a-d007fbb7e34f

sso-mfa/k8s/authelia/README.md

@@ -46,6 +46,8 @@ Key config points:
 - `identity_providers.oidc.clients[0].redirect_uris` — must match CP-NK-004 (`kc.coulomb.social`)
 - `session.domain` — set to parent domain `coulomb.social` so cookies are valid across
   both `auth.coulomb.social` and `kc.coulomb.social`
+- `default_redirection_url` — `https://users.coulomb.social` when the visitor
+  opened the portal with no follow-up. A provided `rd` still wins
 - `access_control.default_policy: one_factor` — fleet default; MFA is not Authelia’s job
 - `access_control.rules` — domain allowlists by LLDAP group (see below)
 

sso-mfa/k8s/authelia/configmap.yaml

@@ -33,6 +33,12 @@ data:
     ---
     theme: dark
 
+    # A direct visit to the sign-in portal has no follow-up page. Send that
+    # sign-in to the account site. A requested follow-up still wins, including
+    # the return path an application or KeyCape sets. The success screen itself
+    # cannot carry a custom link.
+    default_redirection_url: https://users.coulomb.social
+
     server:
       host: "0.0.0.0"
       port: 9091