[FEATURE REQUEST] Only allow sign-in with identity provider

Could we have the ability to set the configs so users can only sign-in with the identity provider when enabled? This saves us from having to make an extensive whitelist.

On a related note, it would also be useful to have a pattern match option for user emails instead of / in addition to a whitelist, and ALSO useful to be able to enforce username patterns (or auto-generated usernames for identity provider sign-ins).