docs: correct the SSO, LDAP, OneDrive and MCP tutorials against the OAuth provider registration and sign-out code

[silentoplayz]

Summary

I compared the SSO tutorials, the LDAP guide, the OneDrive page and the MCP Notion page with the OAuth provider registration, sign-out and LDAP code.

• Dual OAuth: Google, Microsoft, GitHub and Feishu are separate built-in providers registered independently of the generic OIDC slot, so Microsoft plus Google is supported rather than an unofficial workaround. Microsoft is not "handled via the generic OIDC flow": it uses its own tenant discovery URL, and OPENID_PROVIDER_URL registers nothing without OAUTH_CLIENT_ID. Sign-out discovers the end-session endpoint from the session's provider, so OPENID_PROVIDER_URL is not required for Microsoft logout (removed from the Entra page too). Login callback URIs come from *_REDIRECT_URI or the request, not WEBUI_URL, which only sets where the browser lands after sign-in. The rest of the dual OAuth page (description, overview, configuration logic) now matches, and so do the Entra test step and the OneDrive toggle wording.
• Entra and Okta: admin group memberships have been synced like everyone else's since Open WebUI v0.8.11. The current variable name is OAUTH_GROUPS_CLAIM (the old name is a fallback). An empty claim touches nothing, and OAUTH_BLOCKED_GROUPS are never changed.
• LDAP: LDAP_USE_TLS means LDAPS from connect (no STARTTLS), and in Docker certificates go through LDAP_CA_CERT_FILE: without it the LDAP client uses the CA store of the machine or container it runs in, and a container does not see the host's store.
• OneDrive: ENABLE_ONEDRIVE_INTEGRATION=true seeds the admin toggle on a fresh database. The toggle only overrides it once a stored value exists.
• MCP Notion: Import opens a file chooser rather than accepting pasted JSON.

Related issue or discussion

None.

Checklist

• I have reviewed the relevant documentation and matched the existing style.
• This PR meets Open WebUI's contribution standards: it is accurate, relevant to users, narrowly scoped, maintainable, and not promotional content, advertising, lead generation, SEO placement, or a request to list a product, service, provider, integration, gateway, tool, or company primarily for visibility.
• I understand that PRs that do not meet these standards may be closed without review and will not be merged. Repeated, low-quality, off-topic, promotional, or intentionally misleading submissions may result in the contributor being blocked from future participation in Open WebUI repositories.

Notes for reviewers

Sources on dev: config.py (load_oauth_providers, OAUTH_GROUPS_CLAIM, DEFAULT_CONFIG), routers/auths.py (sign-out metadata lookup, the LDAP Tls and Server calls), and utils/oauth.py (update_user_groups, redirect_uri). Also the commit that removed the admin guard (a1aceb5f8, first tag v0.8.11), models/config.py (seed_defaults), and src/lib/components/AddToolServerModal.svelte.