The main thing that's missing is that if users change their email address in Drupal or Clef, their accounts will no longer be in sync, and attempting to log in to Drupal again using Clef will result in the user being registered again (if possible).
Another potential feature to add would be a setting to disable the native login/registration system completely.