feat: add OIDC auto-provision setting independent of registration toggle (#795)

Allows OIDC-authenticated users to be auto-provisioned even when
"Allow new account registration" is disabled. Adds an admin UI toggle
and corresponding API endpoints (GET/PATCH /users/oidc-auto-provision).
Falls back to OIDC_ALLOW_REGISTRATION env var if the setting is unset.

src/ui/main-axios.ts

@@ -3326,6 +3326,28 @@ export async function updateRegistrationAllowed(
   }
 }
 
+export async function getOidcAutoProvision(): Promise<{ enabled: boolean }> {
+  try {
+    const response = await authApi.get("/users/oidc-auto-provision");
+    return response.data;
+  } catch (error) {
+    handleApiError(error, "check OIDC auto-provision status");
+  }
+}
+
+export async function updateOidcAutoProvision(
+  enabled: boolean,
+): Promise<Record<string, unknown>> {
+  try {
+    const response = await authApi.patch("/users/oidc-auto-provision", {
+      enabled,
+    });
+    return response.data;
+  } catch (error) {
+    handleApiError(error, "update OIDC auto-provision");
+  }
+}
+
 export async function updatePasswordLoginAllowed(
   allowed: boolean,
 ): Promise<{ allowed: boolean }> {

src/ui/sidebar/AdminSettingsPanel.tsx

@@ -31,6 +31,8 @@ import {
   getAdminOIDCConfig,
   updateOIDCConfig,
   disableOIDCConfig,
+  getOidcAutoProvision,
+  updateOidcAutoProvision,
   isElectron,
   getUserRoles,
   assignRoleToUser,
@@ -134,6 +136,7 @@ export function AdminSettingsPanel() {
   const [logLevel, setLogLevel] = useState("info");
 
   // OIDC state
+  const [oidcAutoProvision, setOidcAutoProvision] = useState(false);
   const [oidcClientId, setOidcClientId] = useState("");
   const [oidcClientSecret, setOidcClientSecret] = useState("");
   const [oidcAuthUrl, setOidcAuthUrl] = useState("");
@@ -238,7 +241,7 @@ export function AdminSettingsPanel() {
 
   async function loadGeneralSettings() {
     try {
-      const [reg, pwLogin, pwReset, timeout, monitoring, level, guac] =
+      const [reg, pwLogin, pwReset, timeout, monitoring, level, guac, oidcProv] =
         await Promise.allSettled([
           getRegistrationAllowed(),
           getPasswordLoginAllowed(),
@@ -247,11 +250,14 @@ export function AdminSettingsPanel() {
           getGlobalMonitoringSettings(),
           getLogLevel(),
           getGuacamoleSettings(),
+          getOidcAutoProvision(),
         ]);
 
       if (reg.status === "fulfilled") setAllowRegistration(reg.value.allowed);
       if (pwLogin.status === "fulfilled")
         setAllowPasswordLogin(pwLogin.value.allowed);
+      if (oidcProv.status === "fulfilled")
+        setOidcAutoProvision(oidcProv.value.enabled);
       if (pwReset.status === "fulfilled") setAllowPasswordReset(pwReset.value);
       if (timeout.status === "fulfilled")
         setSessionTimeout(String(timeout.value.timeoutHours));
@@ -321,6 +327,17 @@ export function AdminSettingsPanel() {
     }
   }
 
+  async function handleToggleOidcAutoProvision() {
+    const newVal = !oidcAutoProvision;
+    setOidcAutoProvision(newVal);
+    try {
+      await updateOidcAutoProvision(newVal);
+    } catch {
+      setOidcAutoProvision(!newVal);
+      toast.error("Failed to update OIDC auto-provision setting");
+    }
+  }
+
   async function handleTogglePasswordReset() {
     const newVal = !allowPasswordReset;
     setAllowPasswordReset(newVal);
@@ -700,6 +717,15 @@ export function AdminSettingsPanel() {
               onToggle={handleTogglePasswordLogin}
             />
           </SettingRow>
+          <SettingRow
+            label="OIDC Auto-Provision"
+            description="Auto-create accounts for OIDC users even when registration is disabled"
+          >
+            <AdminToggle
+              on={oidcAutoProvision}
+              onToggle={handleToggleOidcAutoProvision}
+            />
+          </SettingRow>
           <SettingRow
             label="Allow Password Reset"
             description="Reset code via Docker logs"