First: It looks really nice, Lars.
A few comments:
The terminology "domain" is ok. (User is related to a certain group/domain - i.e. "student", "staff", "local")
I guess the domain contains a "full name" in addition to pretty-name. This could be used to generate "full-username"
from "username" + "domain full-name" - like the example in "Login Without Explicit Domain"
This would also conform with i.e. IMP webmail, where the
"domains" are the different imap-servers.
I'll continue read the spec and perhaps give some more comments...
Bernt
