Currently, when using OIDC authentication with Postal, if a user successfully authenticates with the configured OpenID Connect provider (e.g., Keycloak, Entra ID, Okta, Google),
but does not yet exist in Postal’s local database, the login fails with:

“No user was found matching your identity. Please contact your administrator.”

It would be great if Postal could automatically create a local user account the first time an OIDC user logs in — similar to Just-In-Time (JIT) provisioning.

⸻

Proposed behavior:

When a user successfully authenticates via OIDC:
1. Postal checks if the email (or the email / preferred_username claim) already exists in the local user table.
2. If not found, Postal automatically creates a new account with:
• Email from the OIDC claim (email)
• Name from name, given_name, and family_name claims
• Role: configurable default (e.g., “user” or “viewer”)
3. Assign this user to a default / new organization.
4. Allow admins to disable or restrict auto-creation via configuration.