Issue with new user creation via OIDC SSO in Liferay 2026.Q1

Capabilities Security
1

We are implementing OpenID Connect authentication in Liferay DXP 2026.Q1 using Red Hat SSO / Keycloak integrated with Active Directory.

Current scenario:

  • Existing users authenticate using LDAP and screenName (loginName from AD).

  • OIDC authentication is already working correctly for existing Liferay users.

  • The OIDC provider is configured with:

    • matcherField = screenName

    • scopes = openid email profile

  • The token and userinfo endpoints are working correctly.

Problem:
When a new user authenticates through SSO and does not yet exist in Liferay, the following error is generated:

com.liferay.portal.security.sso.openid.connect.internal.exception.StrangersNotAllowedException: Company 20101 does not allow strangers

We enabled:

  • company.security.strangers=true

using OSGi configuration:
com.liferay.portal.security.auth.configuration.CompanyServiceConfiguration.config

After verifying through Gogo Shell, the configuration is correctly loaded.

However, the error continued until we enabled the public “Create Account” option in Liferay. Once “Create Account” was enabled, OIDC started creating new users automatically.

This behavior suggests that in Liferay DXP 2026.Q1 the OIDC auto-provisioning mechanism depends on the same validation used for public self-registration.

Our concern:
We do NOT want to allow public/manual account creation from the login page. We only want:

  • automatic user provisioning through trusted SSO authentication

  • no public signup capability

Current workaround:

  • Keep company.security.strangers=true

  • Hide the “Create Account” button from the Login widget/UI

Questions:

  1. Is there another supported configuration to allow automatic OIDC user creation without enabling public self-registration?

  2. Is there an OIDC-specific provisioning flag available in DXP 2026.Q1?

  3. What is the recommended enterprise approach for enabling SSO auto-provisioning while preventing public account creation?

1 Answer

1
2

Hi @candresc

Welcome to the Liferay Discuss Community. :slight_smile:

Is there another supported configuration to allow automatic OIDC user creation without enabling public self-registration?

No, in DXP 2026.Q1, there is currently no way to decouple OIDC auto-provisioning from the company.security.strangers setting.

Is there an OIDC-specific provisioning flag available in DXP 2026.Q1?

Not at this time. There have been feature requests to introduce an “Unknown Users Are Strangers” setting for each OIDC provider, similar to what DXP already supports for SAML. This would allow OIDC auto-provisioning to be configured independently from the public registration setting. However, this enhancement has not yet been included in the product roadmap.

What is the recommended enterprise approach for enabling SSO auto-provisioning while preventing public account creation?

Your current workaround is the recommended approach and follows the guidance provided to other customers in similar situations:

  • Keep company.security.strangers=true to allow OIDC auto-provisioning.

  • Hide or remove the “Create Account” option from the login UI.

In DXP 2025.Q3 and later (including 2026.Q1), you can do this by removing/not configuring the Create Account Utility Page under Site Settings > Pages > Utility Pages. See here: Using OpenID Connect - Liferay Official Documentation - Liferay Learn

Alternatively, you could customize the Sign-In theme or fragment to hide the link.

I hope this helps!