We have a configuration option to say if SAML users can authenticate with a login/password. But it lacks of granularity. We should be able to say that a user can authenticate only with a login/password, or only with SAML.