System wide toggle for org admin user/team abilities

awx/main/conf.py

@@ -43,6 +43,29 @@ register(
     category_slug='system',
 )
 
+register(
+    'ORGS_CAN_CREATE_USERS',
+    field_class=fields.BooleanField,
+    label=_('Organization Admins can create users.'),
+    help_text=_('Enable Organizations to create users. You may want to '
+                'disable this if you populate your users from some external source '
+                'like LDAP or SAML.'),
+    category=_('System'),
+    category_slug='system',
+)
+
+register(
+    'ORGS_CAN_ASSIGN_USERS_TEAM',
+    field_class=fields.BooleanField,
+    label=_('Organization Admins can assign users to teams.'),
+    help_text=_('Enable Organizations to assign users to teams. You may want to '
+                'disable this if you populate your users from some external source '
+                'like LDAP or SAML. This will prevent team assignments for '
+                'Organization and Team admins.'),
+    category=_('System'),
+    category_slug='system',
+)
+
 register(
     'TOWER_ADMIN_ALERTS',
     field_class=fields.BooleanField,
@@ -90,7 +113,6 @@ register(
     category_slug='system',
 )
 
-
 def _load_default_license_from_file():
     try:
         license_file = os.environ.get('AWX_LICENSE_FILE', '/etc/tower/license')
@@ -102,7 +124,6 @@ def _load_default_license_from_file():
         logger.warning('Could not read license from "%s".', license_file, exc_info=True)
     return {}
 
-
 register(
     'LICENSE',
     field_class=fields.DictField,
@@ -484,7 +505,6 @@ register(
     category_slug='logging',
 )
 
-
 def logging_validate(serializer, attrs):
     if not serializer.instance or \
             not hasattr(serializer.instance, 'LOG_AGGREGATOR_HOST') or \