I'm studying Salesforce Identity and have this scenario.  ACME uses a LDAP directory for its partner users.  How to set up SSO to support the following use cases: 

(1) Create new users for new partners in LDAP and Salesforce.  A partner lead is converted to partner account and contact.

(1.1) How to send user info to LDAP?  It takes a custom integration, right? 

(1.2) How to make sure the password is in LDAP not Salesforce? We need a custom registration form integrated with LDAP, right? 

(2) New partner contacts can be added. Then they need to register as community users.   

(2.1) We need the custom integration in (1.1) and the custom registration form in (1.2), right? (2.2) If they register with a Salesforce registration handler, how would their credentials get into LDAP? 

(3) De-provision users once a partner become inactive in Salesforce.  

(3.1) We can use an Apex trigger to deactivate a user in Salesforce. Is there any complication here? 

(3.2) It take a custom integration to deactivate a user in LDAP, right?

(4) Does OKTA or Ping Federate automate any use case? If yes, I'd appreciate to get the references to learn how they work.