Alright so only existing MantisBT user accounts.

I would use get_user but just use the already added parameter so that it is not allowed to create users. We might need to rename it though

What about users that exist in a connected LDAP environment but not yet in MantisBT? Do we allow creating those or disallow them as well?

I think allowing and disallowing for LDAP users both have its merrits but i'm leaning towards disallowing. You?