info.magnolia.security.app.dialog.action.SaveUserDialogAction for creation of new user everytime uses first usermanager which support creation of user, but instead of it UserManager for appropriate realm should be used.

Problem is in method SaveUserDialogAction#createOrUpdateUser where UserManager is obtained by securitySupport.getUserManager(). It returns info.magnolia.cms.security.DelegatingUserManager and DelegatingUserManager.createUser method uses first UserManager which support creation of the user.

You can't see any problems with standard magnolia installation. Because standard setting of userManagers look like this:

- server
-- security
--- userManagers
---- system
---- admin
---- public

So when you are creating admin user by using Security app. Then userManager for system realm is used and #createUser method in system user manager can handle it. But problem with this starts occur when you are customize userManagers setting. If you add your custom userManger(which has custom #createUser method) to first place in userManagers then issue will pop-up.