jp, i think something along the line of comparing the email to an AD then adding them as a user OR put something in your LDAP that would allow for roles based on AD group assignment from example, agent would equal agentGroup in AD groups and user would work the same way that way. Similar to this wordpress plugin,https://wordpress.org/plugins/active-directory-integration/