The only method I'm aware of to get "automatic user provisioning" is to utilize the create shadow user functionality. Our team has used it inside SAP to allow us to authenticate users without requiring addition of specific scopes (and the associated manual provisioning of users). In our use case, we add a middleware function to the appprouter designed to verify that the user's e-mail is associated with a specific domain - we only have to take that extra step as our IDP can source non-SAP accounts. There's probably variations to that you could apply as well.
Is there a reason you wish to avoid the create shadow user capability, though?
(and -- if it would help -- I can provide an example of the middleware function).
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.