LdapProvisioner uses the 'modifytimestamp' attribute to determine last provisioned time, but this may not be exactly correct since another process could have updated LDAP. Consider doing what ChangelogProvisioner does (database lookup) and perhaps having ProvisionerBehavior maintain last provisioned time on behalf of all provisioning plugins.