The current validation in the idmap plugin is a little too strict. Overlap with disabled directory services should be allowed. DS_TYPE_ACTIVEDIRECTORY may overlap with DS_TYPE_DEFAULT_DOMAIN if the AD backend is autorid. Domains with 'AD' backend may overlap.