The code to create a new user on the fly when it is not found locally but it is present in the ldap server should be wrapped in a transaction.

This is important because the user might be created halfway if the script dies for any reason.

But it is also important because that script is taken as example by developers when doing their own login handlers - and when in developing phase their script is bound to crash and burn many times, thus leaving many zombie users in the system...