Pr auto create user OIDC #3481
Open
Pr auto create user OIDC #3481
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Collaborator
|
Thanks for the PR, can you explain why you needed to delete docker-compose.yml? I'm not sure why the name logic changed either? The organisation thing is interesting though |
Author
|
The deletion of docker compose was a mistake |
added 2 commits
November 11, 2025 00:24
This reverts commit 0a2205a. Mistake in deletion of docker compose#
Author
|
name logic ? |
Contributor
|
This PR is stale because it has been open 45 days with no activity. Remove stale label or comment or this will be closed in 10 days. |
michaeldoehler
pushed a commit
to relationsoftware/postal
that referenced
this pull request
Jan 21, 2026
Adds support for: - OIDC_AUTO_CREATE_USERS: Automatically create user records for valid OIDC logins - OIDC_AUTO_CREATE_ORGANIZATION: Create a default organization for auto-created users - OIDC_AUTO_CREATED_ORGANIZATION_NAME: Customize the organization name Cherry-picked from postalserver/postal PR postalserver#3481 (OIDC features only) Co-authored-by: aalonzolu <aalonzolu@users.noreply.github.com> Co-authored-by: openhands <openhands@all-hands.dev>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
✨ Summary
Currently, when using OIDC authentication with Postal, if a user successfully authenticates with a configured OpenID Connect provider (e.g. Keycloak, Entra ID, Okta, Google), but does not yet exist in Postal’s local database, the login fails with:
“No user was found matching your identity. Please contact your administrator.”
This PR introduces Just-In-Time (JIT) provisioning for OIDC users — allowing Postal to automatically create a corresponding local user account (and organization) upon their first successful login.
⸻
🚀 Proposed Behavior
When a user authenticates via OIDC:
1. Postal checks if a local user with the same email (or email / preferred_username claim) already exists.
2. If not found, Postal automatically creates a new user with:
• Email from the OIDC claim (email)
• Name from the name, given_name, and family_name claims
• Role: configurable default (e.g. user, viewer)
3. Assigns this user to a default or newly created organization.
4. Allows administrators to enable / disable this behavior via configuration.
⸻
⚙️ Configuration Example
oidc:
Enable OIDC authentication
enabled: false
When enabled, users with passwords will still be able to login locally. If disable, only OpenID Connect will be available.
local_authentication_enabled: true
Automatically create a user record when a valid OIDC login is received but no user exists
auto_create_users: false
Automatically create a default organization for auto-created users
auto_create_organization: false
The name to use for automatically created organizations
auto_created_organization_name: My organization
The name of the OIDC provider as shown in the UI
⸻
🧩 Motivation
This feature simplifies SSO onboarding and reduces manual user management for organizations using external identity providers.
It aligns Postal with standard enterprise SSO behavior (e.g. Keycloak JIT provisioning), improving compatibility for SaaS and multi-tenant deployments.
⸻
🧪 Notes
• The feature is opt-in and disabled by default.
• Tested with Keycloak OIDC flows.
⸻