People can currently login as 'foo@bar' or 'bar\foo' or just 'foo', but from Jenkins point of view the user on each of those possibilities is a different user. It could be nice to have a Dropdown menu in which AD admins could indeed restrict the way users can login as from Jenkins point of view 'foo@bar' != 'bar\foo' != 'foo'