Currently when LDAP is enabled for login control, user auto-creation must be enabled to create new users. Alternately per Ohad the following line in app/controllers/users_controller.rb can be commented out:

config.actions.exclude :create

This feature should a) be controllable by the GUI, and b) should be expanded to allow users to specify a DN for an LDAP group to restrict access during autocreation.