I have been investigating the preview feature 'JWT Authorization Grant' https://www.keycloak.org/securing-apps/jwt-authorization-grant for external to internal token exchange and have found that I can generate a token in the configured Okta IDP and then exchange that Token using the end point /realms/{realim}/protocol/openid-connect/token for a Keycloak token.

The end goal of this work is to allow a third party application pass an IDP token to our application which will then authenticate with Keycloak using the IDP token.

This works, as long as the IDP user already exists in Keycloak. If the IDP user does not exist in Keycloak I get a 'user not found' error.

If I login using the browser for the same IDP I can use the first broker login flow to automatically create the user.

My questions are:

• Is this a configuration option already that I might have missed that would execute the first broker login flow?
• If not, is there something else I can do to trigger the user creation?
• Or can I create a Keycloak extension that would do similar?
• Finally, with the above failing, is this a reasonable feature request?