I was asking yesterday about the %ENV hash, and that seems to be the wrong way to look at the issue.
CPAN has plenty of modules for LDAP and ADS and Kerberos, but I really need one that doesn't do the authentication so much as reads the authentication already done when a user logs onto the ADS domain. There isn't any security issue here, as I'm talking about a private, secured network.