Grant a resource's email whitelist to OIDC/SSO users without provisioning an org user

[dede34fr]

Use case

Family / guest access to self-hosted apps behind Pangolin.

We protect several resources with SSO (OIDC / Google IdP) and a per-resource email whitelist. The one-time-code (email whitelist) path works great and, importantly, does not create an org user — which is perfect for guests.

What we'd like

We'd like those same whitelisted people to also be able to use the "Login with Google" button for convenience — but without provisioning an org user + role for each of them.

Today the SSO button requires the user to be provisioned into the org (IdP org policy orgMapping / roleMapping) and assigned a role. Granting a role exposes every resource that role covers, and it creates/maintains a user per person — which defeats the point of a per-resource whitelist.

Question / request

Is there a way (config we might be missing) for an OIDC/SSO-authenticated user to be granted access to a resource based solely on their verified IdP email matching that resource's email whitelist, without being provisioned as an org user or given an org role?

If not supported today, could it be considered as a feature — treating a verified IdP email as equivalent to the whitelist (one-time-code) identity, so SSO login + resource-whitelist match = access, no org membership?

Why it matters

For family / community deployments, the per-resource email whitelist is the natural access model. Having to create and manage an org user (and pick a role that over-grants) for anyone who wants the SSO button is real friction and a least-privilege concern.

Thanks!

[Thecoolpeople]

+1 I think that would be a great improvement. I am searching for a solution for that.