Allowed email domains
Auto-provision users on first SSO login
Default role for auto-provisioned users
Optional
For SAML: metadata URL; for OIDC: discovery endpoint
Allowed email domains