OIDC register users

[VermiumSifell]

Once authorised, you will be directed back to the application. If a user exists matching the e-mail address returned by the OpenID provider, it will be linked and you will be logged in. If not, an error will be displayed.

I think that it should be able to register users by itself if the email isn't in the system, and that the OIDC should manage the permissions of who can register. Atleast this behavior should be available by a config option

[willpower232]

I can appreciate the desire for automation however one wrong move could allow literally anyone to access the Postal web ui so it is much safer in my opinion if the users have to be created first.

[VermiumSifell]

I think it would be awesome let's say if it is a feature that an administrator can opt-in by either webui or env config

[arthurzenika]

I agree. Having to add users "by hand" when the SSO is configured is a bit cumbersome for our use case. To compare with Grafana's SSO/oidc/oauth mecanism https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/saml/ it creates users on the fly if they are valid accounts in the OIDC exchange.

[arthurzenika]

Related : https://github.com/orgs/postalserver/discussions/2682