LDAP integration in moodle and accounts

I am still getting my head around LDAP authentication.  LDAP = good for customer - BECAUSE we use their existing authentication data.  Period.

Moodle can *gain access to this data by being told how to connect it, moodle, to the LDAP server.  Both of the school districts that we have configured to *read an LDAP server use Active Directory.  Both districts have users who *may want to use Moodle, located in numerous OU's.

OU = Organizational Unit.

Each OU has a unique DN or distinguishedName.  That name uniquely identifies the record at the level "directory" where it sits.  Each DN includes the path to the top of the LDAP tree where it lives.

Using LDAP integration means I am not preloading accounts, like with a csv file.  We have a couple moodle instances where this is the normal method of authentication or account creation.  When we preload hundreds of accounts, only a small percentage are used, the rest of the account data is never used.  Not a real big deal, but using LDAP, accounts are only created when the user actually logs into the system.

I glaced at one of our moodle instances that is configured to read LDAP, at a glace there are 48 accounts created.

This shows me who has logged into the site and when.  Also that some of the accounts have no email.  Moodle normally requires that when creating accounts - but the LDAP con. is not requiring.  Must be the LDAP account does not have an address in the email field or attribute.  I bet, once the email is added to the LDAP OU record, it will be pushed to the moodle account.  There are options in the moodle LDAP conf. for when to update the record in moodle.  I think we have it set to never.  We only want updates from the source LDAP record, to update the moodle account.