Similar to OIDC, CAS providers can now disable registration such
that only existing users are able to login via SSO.