That was how I tried to do it originally. I changed my mind because AuthSource.authenticate is such a general name, and at the moment it does a general thing, testing authentication against every source. I was thinking checking whether auto-creation was allowed belonged in the method called try_to_auto_create_user.

But it seems that's all AuthSource.authenticate will ever be used for, and it makes this less complicated of a change.  

Submitted a new PR with just the test and the small change to auth_source.rb.