Feature: Auto-provision new users on first SSO login (no manual admin invite required)

[David-Bratkov]

Summary

New users who successfully authenticate via SSO (Keycloak OIDC) for the first time are silently rejected and kicked back to the Vaultwarden login screen with no explanation. There is no self-service onboarding path — an admin must manually invite each user from the admin panel before SSO will work for them.

Current Behavior

1. New user completes the full SSO flow (Vaultwarden email input → Keycloak login → redirect back)
2. Keycloak authenticates them successfully
3. Vaultwarden silently rejects them — no account exists, no error shown, no action taken
4. User is returned to the login screen with empty fields
5. No invite email is sent automatically
6. Admin must manually go to /admin → Users → Invite for each new user before they can log in

Expected Behavior

When a user authenticates via SSO for the first time and no Vaultwarden account exists for their email:

Option A (preferred): Automatically send an invite email to the user's address (as returned by the IdP token) and show a page: "An invitation has been sent to your email. Click the link to finish setting up your vault."

Option B: Auto-create the account immediately and prompt the user to set their vault master password in-browser before proceeding.

Either option eliminates the need for per-user manual admin action when onboarding an organization via SSO.

Why This Matters

SSO is designed for organizational onboarding — the IdP is already the authority on who is allowed in. Requiring an admin to manually invite every user before SSO works defeats the main benefit of SSO for teams. Any user who passes IdP authentication should be considered trusted and eligible for auto-provisioning.

Environment

• Vaultwarden: 1.36.0
• IdP: Keycloak 26.x (OIDC), users sourced from LDAP
• SSO_ONLY=true, SSO_ALLOW_UNKNOWN_EMAIL_VERIFICATION=true, PKCE enabled
• ~40 users in organization

[stefan0xC]

Can you share your Support String? Because I don't have that problem on my test instance.

[BlackDex]

It looks more like a feature request to me though. Ill move it to Ideas