Hi,
LDAP is not secure enough to be used across the internet with your On Demand System. SSO can be used instead. If you use a federated SSO such as OCTA or SiteMinder's Federation Manager, your users can still use their LDAP passwords even though LDAP is not directly interfacing with the On Demand System.
You can use ODUM (uploading flat files via a tool you install on your desk top) or a custom WSDL implementation to sync your users with the On Demand Portal. Your users will be automatically added to Clarity when they are added to one of your environments whether that is done when you first upload them or later on.
Test and Dev environments userbases are usually maintained when you refresh from your production system's database. However, users can be added at any time to those environments via the portal.
I hope this helps.
Let me know if you have further questions.
Sincerely yours,
Jeanne Gaskill