Disable Registration Flag about ashirt-server

[jrozner]

Is disabling registration all together preferable to user approval? As written today I don't think it's trivial for us to separate registration from login being enabled for a specific auth provider. If we did it's something that would probably need to be toggled in the config which would then require a restart to enable adding new users again; probably not ideal either. Overall this feature makes sense, we just need to figure out implementation details and timeline. This may end up being a bigger change than it seems just because of how the auth mechanism currently exists and the fact that it wouldn't necessarily make sense for all auth providers (in okta you specifically grant access outside of the app already).

In the mean time, if you need a quicker solution, there are a few stopgaps you could use:

1. Setup basic auth on the reverse proxy to avoid people from accessing ashirt who don't know the password
2. Put network ACLs in place to disallow ashirt access from the internet and require a VPN or proxy that is on the edge to route to it
3. Switch to an OIDC2 provider for auth. Currently it is built around Okta support but I would assume any identity provider that supports OIDC2 would work. We haven't tested this but would be open to implementing changes to ensure this is the case

[jrozner]

@SecPrez not sure if you're still looking for a solution but we're prioritizing this and worked out the details today. Don't have a specific timeline for when we'll have it merged but it's getting worked on and expected to land reasonably soon