The LDAP provisioner is configured to run automatically. New enrollees get the correct groups and attributes assigned in the database, but they are never provisioned in the LDAP directory---and their provisioning status is "Not Provisioned". An administrator can manually provision the account successfully.