I agree Nick. I think those features would make the AD authentication a full-fledged toolkit in the job of interconnecting the two systems.
I think it is necessary to classify this process into the three elements as to not confuse the issue:
User account retrieval (initial synchronization/ new AD accounts and attribute to extension matching; happening on a schedule)
User authentication (a real-time process as needed)
Managing changes (attribute changes, account disabled, account deletion, etc..) to existing (extension mapped) accounts detected in the user account retrieval
I think the first part, user account retrieval, might almost be there if the capabilities Andrew posted in that screenshot can be ported (copied?) into FreePBX. It seems like the second part, user authentication, is fully functional (I haven't seen any bugs with it). The third part (from where I sit) seems wide open right now as I don't know if those requirements have been spec'd yet (apart from the bug Andrew mentioned about account deletions not working),
I am not trying to put too much assumption on how things are or should be done ( as I will be the first to admit I don't know how they are intended to work), but I do think that this is headed in the right direction.
Thanks,
Brian