Are you in a position to make your roles (except admin) SAML Single Sign-on ? We have our users setup this way and they cannot login with their e-mail address and password, they have to go through our SSO gateway