> That checks sAMAccountName, which is unique

Only in Microsoft's schema. If you want to work with just AD, thats fine, but you shouldn't claim to be LDAP compatible if you only work with a single vendor's schema.

> It wouldn't be very user friendly to require a PATCH so a user can change a password

Why? It's a REST API, you're talking to it from code, you aren't asking users to write curl requests.

> You aren't going to enable an account and change a password at the same time very often.

I see you've never worked in a support environment before. If the account becomes locked, its usually because the user tried the wrong password too many times. So, they contact support who can unlock it, and invariably will need to reset the password at the same time.

> I'm definitely open to suggestions

Well I think you need to decide if its targeting AD specifically or any LDAP directory server. If it's the latter, it needs to be a lot more configurable .