IAM, 2FA, and "plus addresses"

For the purposes of login, hwine@mozilla.com is different from hwine+heroku@mozilla.com. In other words, you have a one single LDAP account login (the + accounts will fail to login with LDAP).

For the purpose of setting email aliases and informing services of various emails, both work fine - however, most third party services (relying parties/RPs) do NOT actually read these values.

Note: for non-LDAP accounts, if you were to use hwine@gmail.com and hwine+heroku@gmail.com as your GitHub personal account emails, this would simply use GitHub rules and thus work as long as GitHub let you login with your alternate emails (otherwise, it also wont)