Manually approve new users is not applied to SAML users

Description:

New users using the SAML provider to authenticate are automatically enabled on their first login despite the Manually Approve New Users setting set to ON.

Steps to reproduce:

1. Setup SAML authentication on your instance
2. In Accounts -> Registration, set Manually Approve New Users to ON
3. Login to the instance using SAML for a user that never logged-on before
4. The user appears as "enabled" in the users list without any action from an admin to approve it

Expected behavior:

The users should stay disabled until an admin approve them

Actual behavior:

The users are enabled without any action from an admin to approve it.

Server Setup Information:

• Version of Rocket.Chat Server: 3.11.1
• Operating System: Exherbo - Linux
• Deployment Method: tar
• Number of Running Instances: 1
• DB Replicaset Oplog: Enabled
• NodeJS Version: 12.18.4 - x64
• MongoDB Version: 4.0.3

Additional context

This issue seems to have started since we upgraded to 3.11.0 to fix another issue we had in 3.10.x. Upgrading to 3.11.1 did not solve the issue. Changing the Manually Approve New Users to OFF and then ON again did not help either.

It seems that this issue only happens for the SAML provider, we also have a Google provider for which users are correctly disabled by default, as expected.

Relevant logs:

No particular logs are emitted on the server.

Start by tracing the SAML first-login flow from Accounts → Registration and the Manually Approve New Users setting, then compare it with the Google provider behavior described in the issue. Reproduce with a new SAML user and confirm that the user remains disabled until an administrator approves them.