I’m aware of this plugin.
What can be really handy is HTTP auth plugin, which can live with user@domain usernames and will do LDAP queries on behalf of already authenticated user.
The actual authentication is performed by the browser using a local kerberos context, so there’s no need to type in passwords and such.
