Replica: Pr auto create user OIDC

[lucaforni]

Questa PR replica la PR originale: postalserver#3481

Autore originale: @thib-d
Branch originale: pr_auto_create_user_oidc
Repository originale: GottaPhish/postal

---

✨ Summary

Currently, when using OIDC authentication with Postal, if a user successfully authenticates with a configured OpenID Connect provider (e.g. Keycloak, Entra ID, Okta, Google), but does not yet exist in Postal’s local database, the login fails with:

“No user was found matching your identity. Please contact your administrator.”

This PR introduces Just-In-Time (JIT) provisioning for OIDC users — allowing Postal to automatically create a corresponding local user account (and organization) upon their first successful login.

⸻

🚀 Proposed Behavior

When a user authenticates via OIDC:
1. Postal checks if a local user with the same email (or email / preferred_username claim) already exists.
2. If not found, Postal automatically creates a new user with:
• Email from the OIDC claim (email)
• Name from the name, given_name, and family_name claims
• Role: configurable default (e.g. user, viewer)
3. Assigns this user to a default or newly created organization.
4. Allows administrators to enable / disable this behavior via configuration.

⸻

⚙️ Configuration Example

oidc:

Enable OIDC authentication

enabled: false

When enabled, users with passwords will still be able to login locally. If disable, only OpenID Connect will be available.

local_authentication_enabled: true

Automatically create a user record when a valid OIDC login is received but no user exists

auto_create_users: false

Automatically create a default organization for auto-created users

auto_create_organization: false

The name to use for automatically created organizations

auto_created_organization_name: My organization

The name of the OIDC provider as shown in the UI

⸻

🧩 Motivation

This feature simplifies SSO onboarding and reduces manual user management for organizations using external identity providers.
It aligns Postal with standard enterprise SSO behavior (e.g. Keycloak JIT provisioning), improving compatibility for SaaS and multi-tenant deployments.

⸻

🧪 Notes
• The feature is opt-in and disabled by default.
• Tested with Keycloak OIDC flows.

⸻

[github-actions]

This PR is stale because it has been open 45 days with no activity. Remove stale label or comment or this will be closed in 10 days.

[github-actions]

This PR was closed because it has been stalled for 10 days with no activity.