New users are able to toggle auto-provisioning of accounts without authorization.

[mdwheele]

We're using the WrapAuth plugin in most of our new WP sites and came across the issue where by default, the Wrap plugin auto-provisions WP accounts for unity users that do not have them. Those users can then log into wp-admin and turn that auto-provisioning off.

I have a few spare cycles to fork and put in a fix that only a site administrator is authorized to toggle that setting. Is there another reason why this is the way it is?

[mdwheele]

The documentation or code needs updating as far as the default either way. They are conflicting:

7: The plugin gives you the ability to create users in Wordpress (if they don't already exist) when they log in with WRAP. By default this is turned off, but you can change this option by going under the "Settings" link and then clicking on "WRAP Authentication".

    /**
     * Default values for options
     *
     * @var array
     */
    protected $_defaults = array(
        'autoCreateUser' => true,
    );