iam: opt-in anonymous self-registration

The anonymous token carries no permissions by design (gcl_iam AnonDriver),
so public sign-up via the console register page is impossible through
permission bindings. Gate it on an explicit [iam] allow_self_registration
option (default false): when set, an anon token may create IAM users.

Author: gmelikov

exordos_core/cmd/user_api.py

@@ -63,6 +63,14 @@
         default=c.DEFAULT_HS256_JWKS_ENCRYPTION_KEY,
         help="Encryption key for HS256 JWKS secret (A256GCM, 32 bytes)",
     ),
+    cfg.BoolOpt(
+        "allow_self_registration",
+        default=False,
+        help="Allow anonymous requests to create IAM users (public "
+        "sign-up, e.g. the ecosystem console register page). The "
+        "anonymous token carries no permissions by design, so "
+        "without this option registration is admin-only.",
+    ),
 ]
 
 

exordos_core/user_api/iam/api/controllers.py

@@ -28,6 +28,7 @@
 from gcl_iam.api import controllers as iam_controllers
 from gcl_iam.api import field_perms as iam_fp
 import jinja2
+from oslo_config import cfg
 import pyotp
 from restalchemy.api import actions
 from restalchemy.api import constants as ra_c
@@ -183,11 +184,21 @@ def get(self, uuid, **kwargs):
         return super().get(uuid, **kwargs)
 
     def create(self, **kwargs):
-        self.enforce(
-            c.PERMISSION_USER_CREATE,
-            do_raise=True,
-            exc=iam_e.CanNotCreateUser,
+        # The anonymous token carries no permissions by design (see
+        # gcl_iam AnonDriver), so public sign-up is impossible via
+        # permission bindings alone; it is an explicit installation
+        # choice instead ([iam] allow_self_registration).
+        ctx = contexts.get_context()
+        is_anon_signup = (
+            ctx.iam_context.token_info.token_type == "anon"
+            and cfg.CONF["iam"].allow_self_registration
         )
+        if not is_anon_signup:
+            self.enforce(
+                c.PERMISSION_USER_CREATE,
+                do_raise=True,
+                exc=iam_e.CanNotCreateUser,
+            )
         self.validate_secret(kwargs)
         kwargs.pop("email_verified", None)
         user = super().create(**kwargs)