SSSD maps mail attribute to an account, and allows users to login using e-mail address (value of mail attribute).

This behavior has caused confusion to some customers. Below man page vaguely documents the behavior.

       ldap_user_email (string)

          <...> If for some reason several users
           need to share the same email address then set this option to a
           nonexistent attribute name in order to disable user lookup/login by
           email.

           Default: mail

Could this behavior (allowing users to authenticate using e-mail as a substitute of username) be documented more explicitly?