I'm not sure what you mean by requirement 2, but this is really identity management. We use AD to do both of the above (using LDAP plugin for moodle to talk to it).
+1 for koen's suggestion of move this side of things to a separate authentication system, and point moodle at that.