We currently have https://coder.com/docs/v2/latest/cli/server#--oidc-allow-signups, but it's not particularly helpful since admins cannot manually add users as OIDC. We have this in Coder v1:

Related: #4505

Implementation notes

Open to other ideas, but I believe this should cover most cases.

• If OIDC is enabled, add a type modal in the “add user” dropdown with built-in and OIDC. OIDC should be selected by default.
• If GitHub OAuth is enabled, add a type modal in the “add user” dropdown with built-in and GitHub. GitHub should be selected by default, unless OIDC is also also enabled. In this case, OIDC should be the default.
• Do not require the admin enter a password for these users. The “password” field should conditionally render, only if the type is “built-in.”

Bonus

We don’t have to do this as a part of this issue if it is difficult, but it helps customers secure their deployment, which is a part of this. If we don’t do this, let me know and I can extract it to another issue.

If —disable-password-auth is enabled, we should not allow built-in accounts to be created via the UI or API. The backdoor command to create an admin user (in the help text of that flag) must still work.