Interesting. I didn't realize that was more than LDAP. Gonna look into it, thank you.

EDIT: Works great. Just disabled creating new repos, orgs, and local registrations and that's pretty much what I want.