Further discussions with AS team has yielded something like the following:
<security-domain name="foo">
<ldap-auth server="...">
<jdbc-auth ...>
<extension module="..." class="...">
</security-domain>
This is just a natural language description in the domain model. What "ldap-auth" maps to is an implementation detail.