This was first noticed in DS-994, but is a separate issue. AuthenticationManger.canSelfRegister contains a loop which goes through all the authentication modules configured in the stack of authentication modules, and returns "true" for any particular module's canSelfRegister method. This allows the value of one canSelfRegister method to trump the values of all others in the stack. In cases where a module always returns true for this method (the Shibboleth Authentication module's canSelfRegister method does just this), any logic in any other authentication module's canSelfRegister method is ignored, if this module is used in a stack of authentication modules. This means that the values in dspace.cfg for authentication.password.domain.valid are currently being ignored, if Shibboleth is in the stack of authentication modules.