I don't feel this is a good place to do it.

The use case itself is a bit convoluted. The user name cannot be autocreated, but it can login if the global account exists. I think it would be easier to deny that user attaching global account. I don't think AuthPlugin::autoCreate() is the appropiate place for checking per-wiki autocreation policies.

I've removed this as dep for other bug since I don't think it actually helps the case where _another_ plugin should be making the determination.

For the case where the auth plugin itself wants more control, possibly the newer external authentication interface provides more of that, but haven't had a chance to look it over.

bsitu wrote:

Marked as reviewed per comment 1 and 2

AuthManager (T91699) will replace AuthPlugin. Authentication providers will be able to subscribe to autocreation events in which case their testForAutoCreation( $user ) functions will be invoked and they will be able to veto.