I add users either through Drupal using ldap_provisioning module or simple ldap_add commands.
The external script can be anything from simply touching a file, to emailing, to more complex Perl or Python scripts.
I prefer not to chain commands to either ldap_add command or the ldap_provisioning module and would prefer to only kick off my external script upon users being added/removed or even something as a simple change to the LDAP db.
OpenLDAP has hooks for this in the form of replication. The replication protocol, syncrepl, is specified in the RFC 4533.
The idea here is that a client that understands these extensions can just connect as if it were a replica and receive a live feed of changes (refreshAndPersist mode). There has been some work done towards including this in the c ldap client api, but I'm not aware of any scripting language bindings that include this yet.
Matthew Backes Symas Corporation mbackes@symas.com