Looks like a good approach. I've seen people solve similar problems by implementing LDAP query syntax, but that doesn't allow for your unique identity trick.