Add config flag

Author: svkrieger

app/controllers/v3/users_controller.rb

@@ -39,7 +39,7 @@ def show
 
   def create
     message = UserCreateMessage.new(hashed_params[:body])
-    unauthorized! unless permission_queryer.can_write_globally? || (permission_queryer.is_org_manager? && !message.guid)
+    unauthorized! unless permission_queryer.can_write_globally? || org_managers_can_create_users?(message:)
     unprocessable!(message.errors.full_messages) unless message.valid?
 
     user = UserCreate.new.create(message:)
@@ -93,4 +93,8 @@ def fetch_user_if_readable(desired_guid)
   def user_not_found!
     resource_not_found!(:user)
   end
+
+  def org_managers_can_create_users?(message:)
+    VCAP::CloudController::Config.config.get(:allow_user_creation_by_org_manager) && permission_queryer.is_org_manager? && !message.guid
+  end
 end

lib/cloud_controller/config_schemas/base/api_schema.rb

@@ -68,6 +68,8 @@ class ApiSchema < VCAP::Config
               ]
             },
 
+            optional(:allow_user_creation_by_org_manager) => bool,
+
             logging: {
               level: String, # debug, info, etc.
               file: String, # Log file to use