LDAP Authentication + Drupal Registrations possible issue

Question

I wish to have a site that allows for both LDAP authentication and plain old Drupal authentication (Drupal users without LDAP accounts). LDAP accounts will be employees, while Drupal accounts will just be all other types of users.

I foresee a problem with this in the future: What if a new employee is hired and the username (which is mandated by business rules) is already taken by an existing user. For example, a user "Jason Smith" created an account jasons. A new employee "Jason Sutherland" is then hired and an LDAP account is created for him jasons. Using the LDAP module http://drupal.org/project/ldap, the employee jasons would essentially be locked out of our Drupal site. And no, we cannot ask the user to change their username.

What are my options here? I first thought of forcing LDAP accounts to login by their email, disallowing any users from registering with the suffix @company.org. Since this should be unique, this could potentially solve the issue. Is this a viable solution? How could I do something like this? Would this require hacking the LDAP module a bit? Do I have other options?

Answer 1

If anyone is interested, here are some methods of resolving this:

1. You can do a force creation of all ldap users before putting your application into production. Edit I've written a module for this: http://drupal.org/sandbox/mrryanjohnston/1308882

2. You can require everyone to authenticate with their email addresses. This, too, requires a few modules and a little bit of figuring out, but it can work. This module is the result of some of those efforts: http://drupal.org/sandbox/branana/1300714