- Match groups by DN so the groups claim is populated - Use cn for names; membership-created accounts have no givenName - Add a mastodon connector that only admits Mastodon Users, and pin every client to its connector via allowedConnectors - Register Nextcloud's user_oidc callback without index.php Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>