ldapauth: LDAP Integration module and user creation

I have been using the LDAP Integration modules to authenticate users to an internal web app. After a user is authenticated the user authorization is checked for getting into specific parts of the app.

The work flow goes like this: When a user needs access to this tool, s/he needs to ask for permission first. But before I can grant access, I need the user id in Drupal's "users" table. So every time I have to ask a user to log in once and then let me know before I can grant further authorization.

So I have been poking around in the configuration screens of the LDAPAUTH module and inside the code. It seems that the code creating a local entry for an LDAP user is buried in the ldapauth_login_validate() function. On the other hand, LDAPAUTH's configuration allows a choice of authentication against the local database before LDAP, or LDAP only. There is also an option of logging, or associate a local entry with what's in LDAP, when conflict between a local user entry and LDAP directory occurs.

So it seems that I would be all set if:

1. there is a way to associate a user entry to LDAP directory at creation, or
2. there is a choice of authenticating a user against LDAP directory first then fall back to local database.

What would the experts say? Which way is easier?

Thanks for any comments.