For our (open source) use case we have two types of users:

• developers with LDAP accounts
• users with username/password accounts

We'd like developers that have LDAP accounts to not also have a username/password combination. This is both to reduce confusion (which username/password am I supposed to use?) and for security and auditing reasons.

However, non-developers do not have an LDAP account and should be able to log in using a username and password.

It would be nice to limit user/pass authentication to users without "@example.com" addresses, while LDAP login should be restricted to only those with "@example.com" addresses (this is actually implicit in our setup).