Ask Questions and Find Answers

I am in the process of modifying my current portal to do three things in a new way:

1. Authenticate users using LDAP (Active Directory)
2. Use a value from the LDAP/AD process as a custom user field (OU is what I am currently using because it basically identifies the department)
3. Assign roles based on the value returned by the LDAP/AD process

The "gotcha!" is that I would prefer this to be "ephemeral".  That is, all of this is done in memory without persisting the user and roles in the DB.  Why?  Because the roles will constantly change as people move around in the organization and I am trying to avoid reading through the roles each time and determining which ones need to be removed if the position changes.  So, first question is:  Is this even possible?
I have been able to get the LDAP authentication working.  I have the value from AD being added as a custom field.  And, I have logic that will assign roles at login to the user based on the value from the LDAP/AD process.  However, I have only been able to do that when the user has already been created in the DB.  So, if I cannot do this all in memory without persisting the user and roles in the DB, how should I handle a brand new user that has never signed in before but is a legitimate user as authenticated in LDAP?  My first attempt at trying a new user generated this response:

WARN  [http-nio-8080-exec-9][SecurityPortletContainerWrapper:348] User 0 is not allowed to access URL [url=http://localhost:8080/web/guest/welcome and portlet com_liferay_login_web_portlet_LoginPortlet]http://localhost:8080/web/guest/welcome and portlet com_liferay_login_web_portlet_LoginPortlet[/url]

Searching on the warning produces several unrelated causes and solutions, so I am not sure if I have a configuration issue or just bad assumptions and logic in my code.  Assuming that a completely ephemeral user isn't possible, what would be the suggest way to handle the following:

1.   Authenticate the user using LDAP
2. Add the user and the custom field data to the DB
3. Assign roles to the user
4. Access the portal and menus based on the role assignments

I am most of the way there.  I think I just need help or a better understanding of what is going on when a user authenticates with LDAP and that user is not in the DB....

UPDATE:  The warning was a red herring and  all of what I described above DOES work.  So, the only question in all of this that is unanswered is:
Can a user be completely ephemeral? That is, not persisted in the DB?  I am think that you cannot have a user that hasn't been persisted based on what I see, but could someone confirm that?