OIDC register users

[VermiumSifell]

Once authorised, you will be directed back to the application. If a user exists matching the e-mail address returned by the OpenID provider, it will be linked and you will be logged in. If not, an error will be displayed.

I think that it should be able to register users by itself if the email isn't in the system, and that the OIDC should manage the permissions of who can register. Atleast this behavior should be available by a config option

[willpower232]

I can appreciate the desire for automation however one wrong move could allow literally anyone to access the Postal web ui so it is much safer in my opinion if the users have to be created first.

[VermiumSifell]

I think it would be awesome let's say if it is a feature that an administrator can opt-in by either webui or env config

[arthurzenika]

I agree. Having to add users "by hand" when the SSO is configured is a bit cumbersome for our use case. To compare with Grafana's SSO/oidc/oauth mecanism https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/saml/ it creates users on the fly if they are valid accounts in the OIDC exchange.

[arthurzenika]

Related : https://github.com/orgs/postalserver/discussions/2682

[bendem]

I like the idea of a flag as proposed. We use our internal OIDC server and there is no chance that it is misconfigured to the point of allowing public access.

The whole point of SSO is that we can create a user and give it access in one place and all systems learn about it through OIDC or SAML. If we have to go through all the applications one by one to precreate the user, we might as well not have centralised user management.

[CleopheeVDL]

Ran into exactly the same issue.

I configured the my ldap with a group and only members of said groups can access postal. When trying to log in, postal does not let me do it as there is no email in the database for the current authenticated user. That means that the whole autorization processus of the centralized identity is short-circuited and I still have to do manual work to add/remove users.