I have been experimenting with verified accounts.
This let to the following situation:
# An account was created
# The account got the unverified state
# The user never clicked the verify link
# The email verification was turned off.
# The user tries to login and gets: "invalid username/password", but actual cause is that the account was never verified
# Need to manually resend the user his welcome message from the administrator account.
This is not ideal, the user initially though he had forgotten his password or locked his account.
Not sure if this is an LDAP specific issue, or a more general problem.