It would be nice if it were possible to allow users to change their own email addresses but to require verification by email link.

Requirements

• Only apply restrictions to self service
• Allow admin to disable verification alltogether leaving current behavior
• Allow admin to require verification for rfc822Mailbox and derived attributes
• Allow admin to restrict email verification to specific attributes (verifMailAttributes=mail)
• Allow admin to exclude email verification to specific attributes (noVerifyEmailAttributes=mail2)

Further it would be even better if the admin could provide a set of filters to restrict email addresses to certain patterns or perhaps exclude others like the patterns for user and hostgroup auto members.

Requirements

• Allow restrictions per tenant
• Inclusive regex (@example.com$)
• Exclusive regex (^root@example.com$)
• Make permission/privilege "Bypass email address restrictions" whose members are not subject to the restriction (admin for one...)