graph: Allow to disable the default role assignment on user creation

Introduces a switch ('GRAPH_ASSIGN_DEFAULT_USER_ROLE') to allow to disable the assignment of the default role "User" to newly created users.
This will be used for setups where the role-assignments are populated either manually or during first login (e.g. from OIDC claims)

services/graph/pkg/config/config.go

@@ -99,6 +99,7 @@ type Identity struct {
 type API struct {
 	GroupMembersPatchLimit int    `yaml:"group_members_patch_limit" env:"GRAPH_GROUP_MEMBERS_PATCH_LIMIT" desc:"The amount of group members allowed to be added with a single patch request."`
 	UsernameMatch          string `yaml:"graph_username_match" env:"GRAPH_USERNAME_MATCH" desc:"Option to allow legacy usernames. Supported options are 'default' and 'none'."`
+	AssignDefaultUserRole  bool   `yaml:"graph_assign_default_user_role" env:"GRAPH_ASSIGN_DEFAULT_USER_ROLE" desc:"Whether to assign newly created users the default role 'User'. Set this to 'false' if you want to assign roles manually, or if the role assignment should happen at first login. Set this to 'true' (the default) to assign the role 'User' when creating a new user."`
 }
 
 // Events combines the configuration options for the event bus.

services/graph/pkg/config/defaults/defaultconfig.go

@@ -40,6 +40,7 @@ func DefaultConfig() *config.Config {
 		API: config.API{
 			GroupMembersPatchLimit: 20,
 			UsernameMatch:          "default",
+			AssignDefaultUserRole:  true,
 		},
 		Reva: shared.DefaultRevaConfig(),
 		Spaces: config.Spaces{

services/graph/pkg/service/v0/users.go

@@ -328,7 +328,7 @@ func (g Graph) PostUser(w http.ResponseWriter, r *http.Request) {
 	}
 
 	// assign roles if possible
-	if g.roleService != nil {
+	if g.roleService != nil && g.config.API.AssignDefaultUserRole {
 		// All users get the user role by default currently.
 		// to all new users for now, as create Account request does not have any role field
 		if _, err = g.roleService.AssignRoleToUser(r.Context(), &settings.AssignRoleToUserRequest{