Currently, we on-board users into phabricator manually; i.e. human administrators must add accounts and send invite emails. We'd like to automate this, such that human admins need not be involved in account creation.

We use Google Apps as a primary "truth store" for user identity and authentication, and, for our use case, it's sufficient to say that if you have a <username>@<organization>.com address, you're allowed to have a phabricator account too. Existing functionality (turning on registration in the Google auth provider, but applying a restrictive setting for auth.email-domains) can get us this far.

The problem is, we also want to ensure that users' phabricator usernames match their google usernames - i.e. if your google login is foobar@<organization>.com, then your phabricator username must be foobar as well (we enforce this currently via our manual process, but ... manual process). When users register via Google OAuth, Phabricator does pre-populate the username / real name fields with the values we want, but then, the end-user then has the opportunity to change them. We'd like to have the option to prevent that.