I digged some docs, I think I'll do LDAP+web for user self-servicing+SAML with Shibboleth+maybe OpenID. That will complicate the automated customer setup, but it'll cover many use cases.

Thanks for the help!