For our (open source) use case we have two types of users:
- developers with LDAP accounts
- users with username/password accounts
We'd like developers that have LDAP accounts to not also have a username/password combination. This is both to reduce confusion (which username/password am I supposed to use?) and for security and auditing reasons.
However, non-developers do not have an LDAP account and should be able to log in using a username and password.
It would be nice to limit user/pass authentication to users without "@example.com" addresses, while LDAP login should be restricted to only those with "@example.com" addresses (this is actually implicit in our setup).