users.iam.kubesphere.io is forbidden: User "system:pre-registration" cannot create resource “user...

问题：kubesphere v3.0.0更新至v3.1.0时，ldap账户登陆失败显示如下错误：

error.png

解决：

for user in `kubectl get users -l \!iam.kubesphere.io/origin-uid,iam.kubesphere.io/identify-provider -o jsonpath="{.items[*].metadata.name}"`; do kubectl label user $user iam.kubesphere.io/origin-uid=$user; done
cat << EOF | kubectl apply -f -
apiVersion: iam.kubesphere.io/v1alpha2
kind: GlobalRoleBinding
metadata:
  name: pre-registration
roleRef:
  apiGroup: iam.kubesphere.io
  kind: GlobalRole
  name: pre-registration
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: pre-registration
EOF

参考：https://github.com/kubesphere/kubesphere/issues/3850