Just-in-time provisioning with authoritative identity providers