Similar to OIDC, CAS providers can now disable registration such that only existing users are able to login via SSO.