Option to associate an LDAP server with the Kerberos realm

Company or project name

No response

Use case

Passwordless SSO

Describe the solution you'd like

1. Add an optional association between the Kerberos realm and an LDAP server name in config.xml.
2. When an HTTP request is successfully Kerberos‑authenticated (GSS-SPNEGO) and the mapped user does not exist in any local access storage:
   • If the Kerberos config includes <ldap_server>..., attempt to provision the user using that LDAP server’s configuration (copying what LDAPAccessStorage would do on first successful LDAP auth).
   • Skip the password/bind verification step (since identity was already proven by Kerberos).
   • Retrieve external roles via GSSAPI.
3. Create the user with AuthenticationType::KERBEROS
   • Optionally also AuthenticationType::LDAP (if not disabled via config)
   • If role search requires user bind (i.e. configuration relies on user’s own password) and no password is available, proceed without external roles or (optionally) fall back to GSSAPI or throw.

Describe alternatives you've considered

No response

Additional context

No response