Add experimental ops file for shadow user creation

operations/experimental/README.md

@@ -33,6 +33,7 @@ This is the README for Experimental Ops-files. To learn more about `cf-deploymen
 | [`enable-iptables-logger.yml`](enable-iptables-logger.yml) | Enables iptables logger. | Does not yet work on AWS Jammy stemcells, see https://github.com/cloudfoundry/bosh-linux-stemcell-builder/issues/241 | **NO** |
 | [`enable-nginx-routing-integrity-windows2019.yml`](enable-nginx-routing-integrity-windows2019.yml) | Enables container proxy on the Windows 2019 Diego Cell `rep` and configures gorouter to opt into TLS-enabled connections to the backend. | **Warning: this is very experimental** Requires `../windows2019-cell.yml` | **NO** |
 | [`enable-oci-phase-1.yml`](enable-oci-phase-1.yml) | Configure CC, Diego, and Garden to create app and task containers more efficiently via OCI image specs. | This ops file **cannot** be deployed in conjunction with `rootless-containers.yml`. | **NO** |
+| [`enable-shadow-user-creation-by-org-managers.yml`](enable-shadow-user-creation-by-org-managers.yml) | Enables UAA shadow user creation by org managers. | Requires capi-release >= 1.200.0 | **NO** |
 | [`enable-tls-cloud-controller-postgres.yml`](enable-tls-cloud-controller-postgres.yml) | Enables the usage of TLS to secure the connection between Cloud Controller and its Postgres database | Requires capi-release >= 1.41.0 and `use-postgres.yml` | **NO** |
 | [`enable-traffic-to-internal-networks.yml`](enable-traffic-to-internal-networks.yml) | Allows traffic from app containers to internal networks. Required to allow applications to communicate with the running CredHub in non-assisted mode. | | **NO** |
 | [`fast-deploy-with-downtime-and-danger.yml`](fast-deploy-with-downtime-and-danger.yml) | Risky, but fast. Disable canaries, increase the max number of vms bosh will update simultaneously, and remove `serial: true` from most instance groups to enable faster, but probably downtimeful, deploys. | | **NO** |

operations/experimental/enable-shadow-user-creation-by-org-managers.yml

@@ -0,0 +1,24 @@
+---
+- type: replace
+  path: /instance_groups/name=api/jobs/name=cloud_controller_ng/properties/cc/allow_user_creation_by_org_manager?
+  value: true
+
+- type: replace
+  path: /instance_groups/name=uaa/jobs/name=uaa/properties/uaa/clients/cloud_controller_shadow_user_creation?
+  value:
+    authorities: scim.create
+    authorized-grant-types: client_credentials
+    override: true
+    scope: uaa.none
+    secret: "((uaa_clients_cloud_controller_shadow_user_creation_secret))"
+
+- type: replace
+  path: /instance_groups/name=api/jobs/name=cloud_controller_ng/properties/uaa/clients/cloud_controller_shadow_user_creation?
+  value:
+    secret: "((uaa_clients_cloud_controller_shadow_user_creation_secret))"
+
+- type: replace
+  path: /variables/-
+  value:
+    name: uaa_clients_cloud_controller_shadow_user_creation_secret
+    type: password

units/tests/experimental_test/operations.yml

@@ -45,6 +45,7 @@ enable-nginx-routing-integrity-windows2019.yml:
   - ../windows2019-cell.yml
   - enable-nginx-routing-integrity-windows2019.yml
 enable-oci-phase-1.yml: {}
+enable-shadow-user-creation-by-org-managers.yml: {}
 enable-tls-cloud-controller-postgres.yml:
   ops:
   - ../use-postgres.yml