[SAC] LDAP in Drupal

[Tyler Mitchell (OSGeo)]

With our recent Drupal upgrade and it's related ldap integration  
module, I've done some more tests with increasing the integration  
between Drupal and LDAP.  The earlier versions of the module were not  
ready for more than simple authentication.

By giving the module access to the LDAP manager role, it can now  
allows users to reset their passwords and edit their own attributes.   
There is always concern about using the manager role in the  
application, but largely because we didn't really understand how it  
gets used in Drupal.  Now, the password itself does not appear in  
cleartext in any form in drupal, though it is stored in the database.

How can we build confidence in the use of this module and approach?

Is it possible to have LDAP users edit their own attributes?   
Previously this was not an option, but it would also help reduce the  
use of the manager role.

Tyler