Just-in-time (JIT) user provisioning on first SSO/OIDC login

[aaronnim]

I saw a claim in Google's AI search results that Warpgate supports just-in-time provisioning, meaning it would automatically create a local user account the first time someone logs in through an external IdP (Google, Azure, Apple, or a custom OIDC provider). That sounded useful so I went digging to see how it actually works, poking around a live v0.26.1 instance's admin API (the OpenAPI spec at /@warpgate/admin/api/openapi.json), the SSO credential schemas, and the binary itself looking for any related config flags.

As far as I can tell, this doesn't exist yet. Attaching an SSO credential to an account (POST /users/{user_id}/credentials/sso) requires a user_id that already exists, so the local user has to be created first before an SSO credential can be linked to it. SSO providers are only configured through the static config file too, and there's nothing equivalent to what LDAP has with auto_link_sso_users or the import-users endpoint. LDAP does let an admin explicitly bulk-import directory users, which is the closest thing to provisioning I could find, but it's a manual action an admin triggers, not something that happens automatically when someone logs in for the first time. I also didn't find any flag like trust_unknown_emails or auto_provision anywhere in the API or the binary strings.

So it looks like the AI search result was either hallucinated or describing a different tool entirely. Posting this as a feature idea because it'd be genuinely useful: auto-create a local user with some default role on first successful OIDC or SAML login, the way a lot of IdP-integrated tools handle JIT provisioning, instead of requiring an admin to pre-create every single user before SSO can work for them.

Happy to help test this if anyone picks it up.

[dcskinner]

It isn't clear to me what you are trying to do exactly. I have an SSO provider configured with Warpgate and when a user logs in the first time, a user account is created in Warpgate. That seems to meet the Subject line of this thread and probably what AI told you. It sounds like you are trying to POST to a user account before they login the first time? That wouldn't work.

[aaron-nim-dev]

Hi, I saw it already in the documentation. It's not labeled as Just In Time user provisioning and got confused. Users are created on their first login as well just as you said, thanks!