Checked in the new version of the pubcookie module, which now has configurable support for LDAP. I also added LDAP-to-profile mapping. When a new user logs in with pubcookie, the LDAP query can populate the user's profile if you've made profile field names match your directory server's field names. That's the Way it Should Be. Single-sign on with zero manual data entry.
All right, I'll be honest...it's not really the Way it Should Be, because Mary is going to get married and change her name, and her Drupal site profile is not going to update automatically. But at least she can edit her profile. (Chances are her LDAP entry isn't updated yet, anyway.)