Introduce a configuration option that, when unset, causes registration to not require setting a password. Users registered without a password will not be able to login unless through SSO.