It's certainly not the mainstream use case, but we have heard of a couple other deployments with similar problems because email address doesn't correspond to LDAP login id. I'm not sure if your solution will address every problem deployment, but it's worth a shot. I do think it's worth integrating into the main UI, hiding the new mode behind a checkbox… it'll be easier to test, maintain, document and use.

If we get pressed for time, we could commit the current approach in 12.1 and migrate later, but updating the UI should be straightforward (even with the conditional) and the LDAP settings get stored in a property bag anyway, so that's easy.

I'll integrate your patch and look at migrating the settings. Either way, I'll need your help with testing the final solution, since I don't have an LDAP server configured this way.

Adam