In solution that uses Saml or OpenID Connect SSO for users but not
allows users to be created by public registration, it would be good to
split current "Allow strangers to create account" into
"strangers from untrusted sources" and "strangers from
trusted sources". Latter would mean saml or oidc. With this
separation, new users could be created from Saml and OIDC, which are
typically trusted sources for new users, but not letting users to be
created from registration form (or possible other untrusted sources).
