LDAP provisioning does not run automatically for new enrollees

The LDAP provisioner is configured to run automatically. New enrollees get the correct groups and attributes assigned in the database, but they are never provisioned in the LDAP directory---and their provisioning status is "Not Provisioned". An administrator can manually provision the account successfully.