So I looked into this, Due to WMCS privacy policy, we can't use the WMF SUL directly, we can't use the wikitech LDAP either. The only option is OAuth (the button of "Login with your Github/Google/Microsoft account" you see in places) and mattermost natively doesn't support all OAuthes but it supports GitLab OAuth and it's so customizable that I assume it should just work with our OAuth, I don't want to try it on our own production setup right now, I will setup a test instance and play with it. If that doesn't work, I will file a bug in upstream. Will see how it goes.

Direct registeration should also remain supported, for users who want to remain anonymous, those does not have an account or can not register one (e.g. because of block or interner censorship).

Upstream changes are needed and it has been already requested: https://mattermost.uservoice.com/forums/306457-general/suggestions/40215553-generic-oauth-provider

To have it implemented in upstream, I'd recommend voting in the above link. I can't do it properly without it :/

I voted, however I don't see how this aligns with their organizational focus (private cloud infrastructure) - have you considered taking generic OAuth bits from this fork?

(Right now I get a login form that doesn't say I can't use unified login, and no "create", which is liable to confuse.)

Currently it is not even clear how you log in. The page https://chat.wmcloud.org/login has no "Create account".

It used to have one but we had to stop it due to abuse.