We just enabled Active Directory authentication for a client, but we're not sure about the workflow for setting up users.  It appears that the procedure for adding an AD user to Umbraco is:

- have the AD user log in to the site
- have the Umbraco admin go behind them and set their role and permissions

Our client has a number of users who will making updates to various nodes in the site.  It appears that any user in AD who attempts to log on to Umbraco admin will be successful but will only have Writer permissions and not Editor. 

Is this the intended behavior, or am I missing something?  We would like for the process to be (in order of preference), either:

a) have the umbraco admin set these users up manually beforehand; this doesn't appear to be possible in AD mode -- choosing to Create a user gives no result (no error message, but the user isn't created in the tree)

b)  have the user log in so that the account is created, but they would not have permission to see or modify anything until the umbraco admin has assigned them to a role.

Thanks.