SAML: Allow disabling of SAML signups (#47481)

* Add new error message for signup not allowed errors

* Add documentation on new SAML signup option

* Accept documentation feedback

Co-authored-by: achatterjee-grafana <70489351+achatterjee-grafana@users.noreply.github.com>

* Accept documentation feedback

Co-authored-by: achatterjee-grafana <70489351+achatterjee-grafana@users.noreply.github.com>

* run prettier:write

Co-authored-by: achatterjee-grafana <70489351+achatterjee-grafana@users.noreply.github.com>

pkg/services/login/login.go

@@ -11,6 +11,7 @@ var (
 	ErrInvalidCredentials = errors.New("invalid username or password")
 	ErrUsersQuotaReached  = errors.New("users quota reached")
 	ErrGettingUserQuota   = errors.New("error getting user quota")
+	ErrSignupNotAllowed   = errors.New("system administrator has disabled signup")
 )
 
 type TeamSyncFunc func(user *models.User, externalUser *models.ExternalUserInfo) error

pkg/services/login/loginservice/loginservice.go

@@ -56,7 +56,7 @@ func (ls *Implementation) UpsertUser(ctx context.Context, cmd *models.UpsertUser
 		}
 		if !cmd.SignupAllowed {
 			cmd.ReqContext.Logger.Warn("Not allowing login, user not found in internal user database and allow signup = false", "authmode", extUser.AuthModule)
-			return login.ErrInvalidCredentials
+			return login.ErrSignupNotAllowed
 		}
 
 		limitReached, err := ls.QuotaService.QuotaReached(cmd.ReqContext, "user")