Scenario: Administrator has wants to use LDAP groups. Groups are mapped to the CN of the user, which is "Charles Miller", but he wants people to be able to log in using their sAMAccountName, which would be "cmiller". Allow login (authenticator) to look up users by one attribute, but have the username be some other attribute (i.e. separate login and usernames)