No Authorizations for some APIs

[HesamoddinMonfared]

I use Openmetadata version 1.2.0. But I saw this problem on latest version also.

Some APIs do not use 'authorize' methods. for example for 'userResource.java' there is an API for 'create user', that directly call repository layer and bypass authorization. So every user can use this API, and create a user.

[harshach]

All of our APIs are protected . UserResource createUser is only possible if you enable self-signup is enabled.
For SSO you'll need to be authenticated with you SSO before reaching this endpoint