Allow authentication without an entry

• If just using the directory server for authentication, want to allow the directory server to authenticate identities
• This is mostly applicable for non-password based auth, or cases where the directory server is not the credential store
• For example, cert based auth; SASL auth (GSSAPI, other cases where you pass off the auth decision to sasl), PAM pass through, other types of pass through auth
• In this case, you want to allow the auth even if there is no user entry
• this probably wouldn't work for simple auth (no user entry to retrieve userPassword from)
• Need to be able to use access control, resource limits, groups/roles, CoS, with these user identities