SCIM: Disable auto assign organization if the user has been provisioned (#101307)

* Add isProvisioned field to model

* Add new isProvisioned column to migration

* Disable auto assignment to organization if the user is provisioned

* add annotation to user model

* add annotation to user models

* Remove IsProvisioned field from Identity

* Move new field assignenment and add default value

* Update annotations for user query results

* Remove isProvisioned from identity

* Add new column to test

* Resolve user from identity at SyncOrgHook

pkg/services/user/userimpl/user.go

@@ -134,6 +134,7 @@ func (s *Service) Create(ctx context.Context, cmd *user.CreateUserCommand) (*use
 		Updated:          timeNow(),
 		LastSeenAt:       timeNow().AddDate(-10, 0, 0),
 		IsServiceAccount: cmd.IsServiceAccount,
+		IsProvisioned:    cmd.IsProvisioned,
 	}
 
 	salt, err := util.GetRandomString(10)
@@ -164,7 +165,7 @@ func (s *Service) Create(ctx context.Context, cmd *user.CreateUserCommand) (*use
 	}
 
 	// create org user link
-	if !cmd.SkipOrgSetup {
+	if !cmd.SkipOrgSetup && !usr.IsProvisioned {
 		orgUser := org.OrgUser{
 			OrgID:   orgID,
 			UserID:  usr.ID,

pkg/services/user/userimpl/user_test.go

@@ -57,6 +57,7 @@ func TestUserService(t *testing.T) {
 		require.Equal(t, "login", u.Login)
 		require.Equal(t, "name", u.Name)
 		require.Equal(t, "email", u.Email)
+		require.False(t, u.IsProvisioned)
 	})
 
 	t.Run("delete user store returns error", func(t *testing.T) {