Re-check roles/fields during Cron

Mmmkay, after messing around with this for a while, I found a solution that seems to work fine. I created my own custom module (called "extraz") and added a cron hook that borrows a bit of code from ldap_user.cron.inc and simply adds two function calls during the loop thru user accounts, one to sync fields from ldap to drupal, and one to update the roles based on ldap authorizations:

function extraz_cron() {
	if (module_exists('ldap_user') && module_exists('ldap_authorization')) {
		$ldap_user_conf = ldap_user_conf();
		// code borrowed and adapted from ldap_user.cron.inc
		$query = new EntityFieldQuery();
		$query->entityCondition('entity_type', 'user')
			->propertyOrderBy('uid', 'ASC')
			->addMetaData('account', user_load(1));
		$result = $query->execute();
		$ldap_servers = ldap_servers_get_servers(NULL, 'enabled');
		if (!(isset($result['user']) && count($result['user']) > 0)) {
			return;
		}
		$uids = array_keys($result['user']);
		$user_count = count($uids);
		$batches = floor($user_count / LDAP_SERVERS_MAXFILTER_ORS) + 1;
		for ($batch=1; $batch <= $batches; $batch++) {
			$filters = array();
			$start = ($batch - 1)* LDAP_SERVERS_MAXFILTER_ORS;
			$end_plus_1 = min(($batch)* LDAP_SERVERS_MAXFILTER_ORS, $user_count);
			$batch_uids = array_slice($uids, $start, ($end_plus_1 - $start));
			$accounts = entity_load('user', $batch_uids);
			foreach ($accounts as $uid => $user) {
				// the new stuff: sync user fields and roles
				ldap_user_synch_to_drupal($user->name);
				ldap_authorizations_user_authorizations($user, 'set', NULL, 'logon');
			}
		}
	}
}

The thing to be careful of is that Cron will run slow if there are a huge amount of user accounts. But I run my cron tasks as a command in my crontab file rather than using the web-based one. You can add back in the logic from ldap_user.cron.inc to run only a specified number at a time if you want, but I was worried that the start/stop points would end up mismatched, so I'm just doing all user accounts every time (I have about 400 accounts on my site).