How should IdP-issued users be provisioned when they never touch the Admin UI?

[myclaudejaja]

We're running ContextForge as an enterprise MCP gateway. Our users come from Active Directory, federated into Keycloak, and connect through an IDE as the MCP client (OAuth 2.1 + PKCE, DCR against Keycloak). The Admin UI is restricted to platform admins by policy — regular users have no path to it and never will. So "log in via SSO in the browser once to get provisioned" isn't available to us.

We've been trying to find the supported way to get these users created in ContextForge, but no luck. Any idea what the provisioning for this could be? Because they have an endpoint for creating local users, but users coming in using an IDP don't get any love? Why is that?

[gcgoncalves]

Unfortunately, this usecase is currently not supported. A new API endpoint for authing with SSO would be a new feature to be considered. I'll raise an issue for it.

EDIT: #6409