Multisite - can you disable automatically adding users to the ID 1 site?

[gravelpot]

(I also posted this on the WP.org support forum for this plugin: https://wordpress.org/support/topic/can-you-disable-automatically-adding-users-to-the-id-1-site/)

We recently switched our campus WP multisite (850+ sites, 20k user accounts) from LDAP authentication to SAML with wp-saml-auth. This multisite is configured to auto-provision any new users who can authenticate through our IdP.

Overall, everything is going great (thank you!), but one small difference that will add up over time is that the LDAP plugin had a setting to disable automatically adding auto-provisioned users to the "ID 1" site in the multisite. Since transitioning to SAML, any new auto-provisioned user accounts are being added to the "ID 1" site with the "Subscriber" role.

Our preference would be that auto-provisioned users are only added as network users, but not automatically added to the ID 1 site or any others.

Is there a way to control this through the filter settings? I couldn't find anything in the documentation.

Thanks!

[pwtyler]

At our first pass I can't find a means to avoid adding the user as the plugin currently works, but I think removing the user from blog 1 right after creation would work. We could keep digging and see if we could be smarter about how the user creation goes, but at least part of it may be fundamental to how the core user creation process goes.

<?php
add_action( 'wp_saml_auth_new_user_authenticated', function( $user, $attributes ) {
    if ( is_multisite() ) {
        remove_user_from_blog( $user->ID, 1 );
    }
}, 20, 2 );