Currently, access to resources like Matomo (in 'piwik' db), mail, Icinga and Phabricator use separate user databases. For mail, T5045 was created a while ago, and by finishing that task accounts are migrated to LDAP.

Ideally, only two databases are present: MediaWiki (CentralAuth) and LDAP databases. Most of the aforementioned services support LDAP authentication, and pretty much all identity providers support LDAP for authentication and SAML for federation. At first glance LDAP only seems to be sufficient for now, but a SAML IdP offers much more functionality.