Setting Up Passwordless Email Login with JIT Provisioning for Whitelisted Domains

[tschoesi]

Hello everyone,

I'm currently working with Authentik and I'm trying to implement a specific user authentication flow. I would appreciate any guidance or advice from those who have experience with similar setups.

What I'm Trying to Achieve:
I want to set up a system where users with email addresses from certain whitelisted domains can log in to my applications using a passwordless, email-based authentication method. Additionally, I want these users to be automatically created in Authentik (Just-In-Time Provisioning) upon their first login attempt, without the need for prior registration.

Specific Requirements:

• Passwordless Authentication: Users should receive a one-time login link via email, allowing them to access the system without a password.
• Domain Whitelisting: Only users with email addresses from specific, pre-approved domains should be able to log in and have accounts created.
• Just-In-Time User Provisioning: New users should be automatically created in Authentik upon their first successful login using their email link.
• Application-Specific Access: Once logged in, users should only have access to applications they are authorized to use.

While I understand the basics of setting up email-based authentication in Authentik, I'm not entirely sure how to integrate this with domain whitelisting and JIT user provisioning.

Thank you in advance for your help!

[xyb]

see also: Email OTP